N1Rwhex

**Name of the Vulnerable Software and Affected Versions** OpenBao versions prior to 2.5.3 **Description** The OCI plugin downloader contains an issue in the `ExtractPluginFromImage()` function where plugin binaries are extracted from container images by streaming decompressed tar data via `io.Copy` without a limit on the number of bytes written. An attacker controlling or compromising the OCI registry can provide a crafted image containing a decompression bomb—a file that expands to an arbitrarily large size upon decompression—leading to disk exhaustion. Because the SHA256 integrity check is performed only after the file is fully written to disk, the hash mismatch is detected too late to prevent the impact. This allows an attacker to replace a legitimate plugin image without needing to alter its signature. **Recommendations** Update to version 2.5.3.

**Name of the Vulnerable Software and Affected Versions** Pi-hole Admin Interface versions 6.0 through 6.4 **Description** A reflected DOM-based XSS (Cross-Site Scripting) issue exists in `taillog.js`. An unauthenticated attacker can inject arbitrary HTML into the admin interface by crafting a malicious URL. This occurs because the `file` query parameter is interpolated into an `innerHTML` assignment without proper escaping. Additionally, the Content-Security-Policy lacks a `form-action` directive, which allows injected `<form>` elements to exfiltrate credentials to an external origin. **Recommendations** Update to version 6.5.