Symbiansymoh

**Nome do software vulnerável e versões afetadas** APfell versão 1.4 **Descrição** A vulnerabilidade permite a execução de scripts entre sites (XSS) refletidos e autenticados por meio da função `payloadtypes callback` no endpoint da API “/apiui/command ”. Isso permite que um invasor roube sessões remotas de administradores ou usuários e, potencialmente, adicione novos usuários ao painel de administração. **Recomendações** Para a versão 1.4 do APfell, considere desativar a função `payloadtypes callback` como uma solução temporária até que um patch esteja disponível. Restrinja o acesso ao endpoint da API “/apiui/command ” para minimizar o risco de exploração.

**Name of the Vulnerable Software and Affected Versions** Metasploit versions prior to 4.14.0 (Update 2017061301) **Description** A security issue allowed GET requests to stop running tasks, which should only be allowed via POST requests, as these actions change the service state. This could have enabled an attacker to stop running tasks by tricking an authenticated user into executing JavaScript. **Recommendations** For versions prior to 4.14.0 (Update 2017061301), update to Metasploit 4.14.0 (Update 2017061301) to ensure that only POST requests, which include a secret token to prevent CSRF attacks, are allowed to stop tasks.

**Name of the Vulnerable Software and Affected Versions** MikroTik RouterOS versions prior to 5.0 **Description** A cross-site request forgery issue allows remote attackers to hijack administrator authentication for requests that change the administrator password. This is achieved via a request in the status page to "/cfg" API endpoint, specifically targeting the `password` variable. **Recommendations** For versions prior to 5.0, as a temporary workaround, consider restricting access to the "/cfg" API endpoint until a patch is available. Avoid using the `password` variable in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** OpenKM versions prior to 6.4.19 (build 23338) **Description** A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML via the `Subject` field in a Task to "frontend/index.jsp". **Recommendations** For versions prior to 6.4.19 (build 23338), update to version 6.4.19 (build 23338) or later to resolve the issue.