Aidil Arief

**Name of the Vulnerable Software and Affected Versions** teler-waf versions prior to 0.1.1 **Description** The issue exists due to teler-waf's failure to properly sanitize and filter HTML entities in user input, allowing an attacker to bypass common web attack rules and launch cross-site scripting (XSS) attacks. This enables the execution of arbitrary JavaScript code on the victim's browser, compromising the web application's security. An attacker can exploit this to steal sensitive information, such as login credentials and session tokens, or take control of the victim's browser to perform malicious actions. **Recommendations** For versions prior to 0.1.1, update to version 0.1.1 to fix the vulnerability. As a temporary workaround, consider implementing additional input validation and sanitization measures to minimize the risk of exploitation. Restrict access to sensitive information and session tokens to prevent unauthorized access.

**Name of the Vulnerable Software and Affected Versions** teler-waf versions prior to 0.2.0 **Description** teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. The issue allows an attacker to execute arbitrary JavaScript code on the victim's browser and compromise the security of the web application when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used. An attacker can exploit this to bypass common web attack threat rules in teler-waf and launch cross-site scripting (XSS) attacks, potentially stealing sensitive information or taking control of the victim's browser. **Recommendations** For versions prior to 0.2.0, update to version 0.2.0 or later to patch the vulnerability. As a temporary workaround, consider restricting the handling of special characters in payloads until the update can be applied.

**Name of the Vulnerable Software and Affected Versions** MediaWiki versions prior to 1.35.5 MediaWiki versions 1.36.x prior to 1.36.3 MediaWiki versions 1.37.x prior to 1.37.1 **Description** An issue was discovered in the WikibaseMediaInfo component, which is vulnerable to XSS via the `caption` fields for a given media file. This allows for potential exploitation through the manipulation of these fields. **Recommendations** For MediaWiki versions prior to 1.35.5, update to version 1.35.5 or later. For MediaWiki versions 1.36.x prior to 1.36.3, update to version 1.36.3 or later. For MediaWiki versions 1.37.x prior to 1.37.1, update to version 1.37.1 or later. As a temporary workaround, consider restricting access to the WikibaseMediaInfo component until a patch is applied. Avoid using the `caption` fields in the affected media files until the issue is resolved.