Sajjad Pourali

**Nome do Software Vulnerável e Versões Afetadas** DotNetNuke versão 9.5 **Descrição** Uma falha de cross-site scripting persistente permite que usuários comuns façam o upload de arquivos XML maliciosos contendo scripts executáveis por meio de ferramentas de diário. Ao carregar arquivos XML com scripts de namespace XHTML, invasores podem executar JavaScript arbitrário nos navegadores de outros usuários, o que pode levar à evasão de proteções contra Cross-Site Request Forgery (CSRF)—um mecanismo usado para evitar que comandos não autorizados sejam transmitidos de um usuário em quem a aplicação web confia. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha a correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** Apple OS X Server versions prior to 2.2.3 Apple OS X Server versions 3.x prior to 3.2.1 **Description** A SQL injection issue allows remote attackers to execute arbitrary SQL commands. **Recommendations** For Apple OS X Server versions prior to 2.2.3, update to version 2.2.3 or later. For Apple OS X Server versions 3.x prior to 3.2.1, update to version 3.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** ZLDNN DNNArticle module versions prior to 10.1 for DotNetNuke **Description** The issue allows remote attackers to execute arbitrary SQL commands via the `categoryid` parameter in the RSS page, specifically in the DNNArticleRSS.aspx file. This enables attackers to manipulate database queries. **Recommendations** For versions prior to 10.1, consider restricting access to the DNNArticleRSS.aspx page until a fix is applied, and avoid using the `categoryid` parameter in this context to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MailEnable Professional, Enterprise, and Premium versions 4.26 and earlier, 5.x before 5.53, 6.x before 6.03 **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `Username` parameter in ForgottenPassword.aspx. **Recommendations** For versions 4.26 and earlier, update to version 4.27 or later. For versions 5.x before 5.53, update to version 5.53 or later. For versions 6.x before 6.03, update to version 6.03 or later. As a temporary workaround, consider restricting access to the ForgottenPassword.aspx page until a patch is available. Avoid using the `Username` parameter in the affected ForgottenPassword.aspx page until the issue is resolved.