Sajjad Pourali

**Name of the Vulnerable Software and Affected Versions** DotNetNuke version 9.5 **Description** A persistent cross-site scripting issue allows normal users to upload malicious XML files containing executable scripts via journal tools. By uploading XML files with XHTML namespace scripts, attackers can execute arbitrary JavaScript in the browsers of other users, which may lead to the bypass of Cross-Site Request Forgery (CSRF) protections—a mechanism used to prevent unauthorized commands from being transmitted from a user the web application trusts. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apple OS X Server versions prior to 2.2.3 Apple OS X Server versions 3.x prior to 3.2.1 **Description** A SQL injection issue allows remote attackers to execute arbitrary SQL commands. **Recommendations** For Apple OS X Server versions prior to 2.2.3, update to version 2.2.3 or later. For Apple OS X Server versions 3.x prior to 3.2.1, update to version 3.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** ZLDNN DNNArticle module versions prior to 10.1 for DotNetNuke **Description** The issue allows remote attackers to execute arbitrary SQL commands via the `categoryid` parameter in the RSS page, specifically in the DNNArticleRSS.aspx file. This enables attackers to manipulate database queries. **Recommendations** For versions prior to 10.1, consider restricting access to the DNNArticleRSS.aspx page until a fix is applied, and avoid using the `categoryid` parameter in this context to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MailEnable Professional, Enterprise, and Premium versions 4.26 and earlier, 5.x before 5.53, 6.x before 6.03 **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `Username` parameter in ForgottenPassword.aspx. **Recommendations** For versions 4.26 and earlier, update to version 4.27 or later. For versions 5.x before 5.53, update to version 5.53 or later. For versions 6.x before 6.03, update to version 6.03 or later. As a temporary workaround, consider restricting access to the ForgottenPassword.aspx page until a patch is available. Avoid using the `Username` parameter in the affected ForgottenPassword.aspx page until the issue is resolved.