Symbiansymoh

**Name of the Vulnerable Software and Affected Versions** APfell version 1.4 **Description** The issue allows for authenticated reflected cross-site scripting (XSS) through the `payloadtypes callback` function in the "/apiui/command " API endpoint. This enables an attacker to steal remote admin or user sessions and potentially add new users to the administration panel. **Recommendations** For APfell version 1.4, consider disabling the `payloadtypes callback` function as a temporary workaround until a patch is available. Restrict access to the "/apiui/command " API endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Metasploit versions prior to 4.14.0 (Update 2017061301) **Description** A security issue allowed GET requests to stop running tasks, which should only be allowed via POST requests, as these actions change the service state. This could have enabled an attacker to stop running tasks by tricking an authenticated user into executing JavaScript. **Recommendations** For versions prior to 4.14.0 (Update 2017061301), update to Metasploit 4.14.0 (Update 2017061301) to ensure that only POST requests, which include a secret token to prevent CSRF attacks, are allowed to stop tasks.

**Name of the Vulnerable Software and Affected Versions** MikroTik RouterOS versions prior to 5.0 **Description** A cross-site request forgery issue allows remote attackers to hijack administrator authentication for requests that change the administrator password. This is achieved via a request in the status page to "/cfg" API endpoint, specifically targeting the `password` variable. **Recommendations** For versions prior to 5.0, as a temporary workaround, consider restricting access to the "/cfg" API endpoint until a patch is available. Avoid using the `password` variable in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** OpenKM versions prior to 6.4.19 (build 23338) **Description** A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML via the `Subject` field in a Task to "frontend/index.jsp". **Recommendations** For versions prior to 6.4.19 (build 23338), update to version 6.4.19 (build 23338) or later to resolve the issue.