Andrejtomci

**Name of the Vulnerable Software and Affected Versions** Gitea version 1.23 **Description** An authorization inconsistency exists between the web UI and the API regarding repository forking. The API endpoint `POST /api/v1/repos/{owner}/{repo}/forks` fails to verify the `CanCreateOrgRepo()` permission, checking only `IsOrgMember()`. This allows a read-only organization member, specifically those in teams where `can create org repo` is set to `false`, to create repositories within the organization namespace via the API. An attacker can exploit this by forking an existing repository back into the organization. Since the creator of the fork is granted full admin permissions, they can enable Actions and push malicious workflow files. Because the runner infrastructure and secret injection mechanisms rely on the organization's owner ID, the attacker can execute workflows that exfiltrate all organization-level CI/CD secrets, such as deploy keys, cloud credentials, and API tokens. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Vim versions prior to 9.2.0565 **Description** The `update snapshot()` function in src/terminal.c copies the visible terminal screen into the scrollback buffer during a snapshot. The process involves iterating through the `chars[]` array of each screen cell without an upper bound, relying solely on a NUL terminator to stop. When a cell fills all `VTERM MAX CHARS PER CELL` (6) slots—consisting of a base character and five combining marks—the bundled libvterm returns the array without a terminating NUL. This causes the loop to read past the fixed six-element array and append out-of-bounds values to a buffer reserved for only six characters. A program rendering output inside a :terminal window can trigger this behavior using a short byte sequence, resulting in a crash. **Recommendations** Update to version 9.2.0565.

**Name of the Vulnerable Software and Affected Versions** Pi-hole Admin Interface versions 6.0 through 6.4 **Description** Client hostnames and IP addresses from the FTL database are rendered into the Document Object Model (DOM) without proper escaping in the Network page (network.js) and Dashboard chart tooltips (charts.js/index.js). Although upstream validation in dnsmasq and FTL blocks HTML characters through standard DHCP and DNS paths, the web interface fails to perform output escaping, creating an inconsistency with other properly escaped fields in the same files. **Recommendations** Update to version 6.5.

**Name of the Vulnerable Software and Affected Versions** Pi-hole Admin Interface versions 6.0 through 6.4 **Description** The `formatInfo()` function in `queries.js` renders `data.upstream`, `data.client.ip`, and `data.ede.text` into HTML without proper escaping when a user expands a query row in the Query Log. This allows for stored HTML injection, although JavaScript execution is prevented by the server's Content Security Policy (CSP), which is a security layer that helps detect and mitigate certain types of attacks, including cross-site scripting and data injection. **Recommendations** Update to version 6.5.

**Name of the Vulnerable Software and Affected Versions** Pi-hole Admin Interface versions 6.0 through 6.4 **Description** Configuration values from the '/api/config' endpoint are inserted into HTML value attributes without proper escaping in settings-advanced.js, allowing HTML attribute injection. A double quote in a configuration value allows an attacker to break out of the attribute context. While the server's Content Security Policy (CSP)—a security layer that helps detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS)—prevents JavaScript execution, injected attributes can be used for UI redressing by altering element styling. The main attack vector involves importing a malicious teleporter backup, which bypasses server-side validation for individual fields. **Recommendations** Update Pi-hole Admin Interface to version 6.5.

**Name of the Vulnerable Software and Affected Versions** Pi-hole Admin Interface versions 6.0 through 6.4 **Description** A reflected DOM-based XSS (Cross-Site Scripting) issue exists in `taillog.js`. An unauthenticated attacker can inject arbitrary HTML into the admin interface by crafting a malicious URL. This occurs because the `file` query parameter is interpolated into an `innerHTML` assignment without proper escaping. Additionally, the Content-Security-Policy lacks a `form-action` directive, which allows injected `<form>` elements to exfiltrate credentials to an external origin. **Recommendations** Update to version 6.5.

**Name of the Vulnerable Software and Affected Versions** calibre versions prior to 9.5.0 **Description** calibre is an e-book manager used for viewing, converting, editing, and cataloging e-books. A path traversal flaw exists in the RocketBook (.rb) input plugin (src/calibre/ebooks/rb/reader.py). This allows an attacker to write arbitrary files to any path writable by the calibre process when a user opens or converts a specially crafted .rb file. The issue stems from a failure to apply a previous fix for a similar flaw found in the PDB readers. **Recommendations** Update to version 9.5.0 or later.