Moezbouzayani9

**Name of the Vulnerable Software and Affected Versions** Pi-hole Admin Interface versions 6.2.1 and earlier **Description** The Pi-hole Admin Interface, a web interface for managing the Pi-hole network-level advertisement and internet tracker blocking application, is susceptible to reflected cross-site scripting (XSS). This occurs due to a malformed URL path that is improperly handled on the 404 error page. Specifically, the requested path is included in the class attribute of the body tag without adequate sanitization or escaping. An attacker can exploit this by crafting a URL containing an `onload` attribute, which will execute arbitrary JavaScript code in the victim's browser when the malicious link is visited. Successful exploitation requires an attacker to send a crafted link to a victim, leading to the execution of attacker-controlled JavaScript code within the victim's browser session. **Recommendations** Update to version 6.3 or later.

**Name of the Vulnerable Software and Affected Versions** Icinga Web 2 versions prior to 2.11.5 Icinga Web 2 versions prior to 2.12.13 **Description** A vulnerability in Icinga Web 2 allows an attacker to craft a request that embeds arbitrary Javascript into the interface, enabling them to act on behalf of a user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. Modern browsers with a working CORS implementation sufficiently guard against the vulnerability. **Recommendations** For versions prior to 2.11.5, update to version 2.11.5 or later. For versions prior to 2.12.13, update to version 2.12.3 or later. As a temporary workaround for version 2.12.2, enable a content security policy in the application settings.

**Name of the Vulnerable Software and Affected Versions** Icinga Web 2 versions prior to 2.11.5 Icinga Web 2 versions prior to 2.12.3 **Description** A vulnerability in Icinga Web 2 allows an attacker to craft a URL that, once visited by an authenticated user, manipulates the backend to redirect the user to any location. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. **Recommendations** For versions prior to 2.11.5, update to version 2.11.5 or later. For versions prior to 2.12.3, update to version 2.12.3 or later.