Andrejtomci

**Name of the Vulnerable Software and Affected Versions** Vim versions prior to 9.2.0565 **Description** The `update snapshot()` function in src/terminal.c copies the visible terminal screen into the scrollback buffer during a snapshot. The process involves iterating through the `chars[]` array of each screen cell without an upper bound, relying solely on a NUL terminator to stop. When a cell fills all `VTERM MAX CHARS PER CELL` (6) slots—consisting of a base character and five combining marks—the bundled libvterm returns the array without a terminating NUL. This causes the loop to read past the fixed six-element array and append out-of-bounds values to a buffer reserved for only six characters. A program rendering output inside a :terminal window can trigger this behavior using a short byte sequence, resulting in a crash. **Recommendations** Update to version 9.2.0565.

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, a reflected DOM-based XSS vulnerability in taillog.js allows an unauthenticated attacker to inject arbitrary HTML into the Pi-hole admin interface by crafting a malicious URL. The file query parameter is interpolated into an innerHTML assignment without escaping. Because the Content-Security-Policy is missing the form-action directive, injected <form> elements can exfiltrate credentials to an external origin. This vulnerability is fixed in 6.5.

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, client hostnames and IP addresses from the FTL database are rendered into the DOM without escaping in network.js (Network page) and charts.js/index.js (Dashboard chart tooltips). While upstream validation in dnsmasq and FTL blocks HTML characters via normal DHCP/DNS paths, the web UI performs no output escaping — an inconsistency with other fields in the same file that are properly escaped. This vulnerability is fixed in 6.5.

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without escaping in settings-advanced.js, enabling HTML attribute injection. A double quote in any config value breaks out of the attribute context. JavaScript execution is blocked by the server's CSP (script-src 'self'), but injected attributes can alter element styling for UI redressing. The primary attack vector is importing a malicious teleporter backup, which bypasses per-field server-side validation. This vulnerability is fixed in 6.5.

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, the formatInfo() function in queries.js renders data.upstream, data.client.ip, and data.ede.text into HTML without escaping when a user expands a query row in the Query Log, enabling stored HTML injection. JavaScript execution is blocked by the server's CSP (script-src 'self'). The same fields are properly escaped in the table view (rowCallback), confirming the omission was an oversight. This vulnerability is fixed in 6.5.

**Name of the Vulnerable Software and Affected Versions** calibre versions prior to 9.5.0 **Description** calibre is an e-book manager used for viewing, converting, editing, and cataloging e-books. A path traversal flaw exists in the RocketBook (.rb) input plugin (src/calibre/ebooks/rb/reader.py). This allows an attacker to write arbitrary files to any path writable by the calibre process when a user opens or converts a specially crafted .rb file. The issue stems from a failure to apply a previous fix for a similar flaw found in the PDB readers. **Recommendations** Update to version 9.5.0 or later.