N1Rwhex

**Name of the Vulnerable Software and Affected Versions** OpenBao versions prior to 2.5.3 **Description** The OCI plugin downloader contains an issue in the `ExtractPluginFromImage()` function where plugin binaries are extracted from container images by streaming decompressed tar data via `io.Copy` without a limit on the number of bytes written. An attacker controlling or compromising the OCI registry can provide a crafted image containing a decompression bomb—a file that expands to an arbitrarily large size upon decompression—leading to disk exhaustion. Because the SHA256 integrity check is performed only after the file is fully written to disk, the hash mismatch is detected too late to prevent the impact. This allows an attacker to replace a legitimate plugin image without needing to alter its signature. **Recommendations** Update to version 2.5.3.

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, a reflected DOM-based XSS vulnerability in taillog.js allows an unauthenticated attacker to inject arbitrary HTML into the Pi-hole admin interface by crafting a malicious URL. The file query parameter is interpolated into an innerHTML assignment without escaping. Because the Content-Security-Policy is missing the form-action directive, injected <form> elements can exfiltrate credentials to an external origin. This vulnerability is fixed in 6.5.