Aidil Arief

**Name of the Vulnerable Software and Affected Versions** teler-waf versions prior to 0.1.1 **Description** The issue exists due to teler-waf's failure to properly sanitize and filter HTML entities in user input, allowing an attacker to bypass common web attack rules and launch cross-site scripting (XSS) attacks. This enables the execution of arbitrary JavaScript code on the victim's browser, compromising the web application's security. An attacker can exploit this to steal sensitive information, such as login credentials and session tokens, or take control of the victim's browser to perform malicious actions. **Recommendations** For versions prior to 0.1.1, update to version 0.1.1 to fix the vulnerability. As a temporary workaround, consider implementing additional input validation and sanitization measures to minimize the risk of exploitation. Restrict access to sensitive information and session tokens to prevent unauthorized access.

**Name of the Vulnerable Software and Affected Versions** teler-waf versions prior to 0.2.0 **Description** teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. The issue allows an attacker to execute arbitrary JavaScript code on the victim's browser and compromise the security of the web application when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used. An attacker can exploit this to bypass common web attack threat rules in teler-waf and launch cross-site scripting (XSS) attacks, potentially stealing sensitive information or taking control of the victim's browser. **Recommendations** For versions prior to 0.2.0, update to version 0.2.0 or later to patch the vulnerability. As a temporary workaround, consider restricting the handling of special characters in payloads until the update can be applied.

**Nome do software vulnerável e versões afetadas** Versões do MediaWiki anteriores à 1.35.5 Versões do MediaWiki 1.36.x anteriores à 1.36.3 Versões do MediaWiki 1.37.x anteriores à 1.37.1 **Descrição** Foi descoberta uma falha no componente WikibaseMediaInfo, que é vulnerável a XSS por meio dos campos `caption` de um determinado arquivo de mídia. Isso permite uma possível exploração por meio da manipulação desses campos. **Recomendações** Para versões do MediaWiki anteriores à 1.35.5, atualize para a versão 1.35.5 ou posterior. Para versões do MediaWiki 1.36.x anteriores à 1.36.3, atualize para a versão 1.36.3 ou posterior. Para versões do MediaWiki 1.37.x anteriores à 1.37.1, atualize para a versão 1.37.1 ou posterior. Como solução temporária, considere restringir o acesso ao componente WikibaseMediaInfo até que um patch seja aplicado. Evite usar os campos `caption` nos arquivos de mídia afetados até que o problema seja resolvido.