https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 16:11:00 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-218928 EUVD-2026-218928 https://cve.radiocsirt.org/vuln/euvd-2026-218928 https://cve.radiocsirt.org/vuln/fkie_cve-2023-26047 <p>teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used. This vulnerability allows an attacker to execute arbitrary JavaScript code on the victim&#39;s browser and compromise the security of the web application. An attacker can exploit this vulnerability to bypass common web attack threat rules in teler-waf and launch cross-site scripting (XSS) attacks. The attacker can execute arbitrary JavaScript code on the victim&#39;s browser and steal sensitive information, such as login credentials and session tokens, or take control of the victim&#39;s browser and perform malicious actions. This issue has been patched in version 0.2.0.</p> <p>teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used. This vulnerability allows an attacker to execute arbitrary JavaScript code on the victim&#39;s browser and compromise the security of the web application. An attacker can exploit this vulnerability to bypass common web attack threat rules in teler-waf and launch cross-site scripting (XSS) attacks. The attacker can execute arbitrary JavaScript code on the victim&#39;s browser and steal sensitive information, such as login credentials and session tokens, or take control of the victim&#39;s browser and perform malicious actions. This issue has been patched in version 0.2.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-26047 https://cve.radiocsirt.org/vuln/ghsa-p2pf-g8cq-3gq5 <p><strong>Affected:</strong> Go: github.com/kitabisa/teler-waf</p> <p>### Description</p> <p>teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used. This vulnerability allows an attacker to execute arbitrary JavaScript code on the victim&#39;s browser and compromise the security of the web application.</p> <p>### Impact</p> <p>An attacker can exploit this vulnerability to bypass common web attack threat rules in teler-waf and launch cross-site scripting (XSS) attacks. The attacker can execute arbitrary JavaScript code on the victim&#39;s browser and steal sensitive information, such as login credentials and session tokens, or take control of the victim&#39;s browser and perform malicious actions.</p> <p>### Patches</p> <p>Version [v0.2.0](https://github.com/kitabisa/teler-waf/releases/tag/v0.2.0) includes a patch for this vulnerability.</p> <p>### Workarounds</p> <p>We advised updating their installations to version v0.2.0 and frontwards immediately.</p> <p><strong>Affected:</strong> Go: github.com/kitabisa/teler-waf</p> <p>### Description</p> <p>teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used. This vulnerability allows an attacker to execute arbitrary JavaScript code on the victim&#39;s browser and compromise the security of the web application.</p> <p>### Impact</p> <p>An attacker can exploit this vulnerability to bypass common web attack threat rules in teler-waf and launch cross-site scripting (XSS) attacks. The attacker can execute arbitrary JavaScript code on the victim&#39;s browser and steal sensitive information, such as login credentials and session tokens, or take control of the victim&#39;s browser and perform malicious actions.</p> <p>### Patches</p> <p>Version [v0.2.0](https://github.com/kitabisa/teler-waf/releases/tag/v0.2.0) includes a patch for this vulnerability.</p> <p>### Workarounds</p> <p>We advised updating their installations to version v0.2.0 and frontwards immediately.</p> https://cve.radiocsirt.org/vuln/ghsa-p2pf-g8cq-3gq5 https://cve.radiocsirt.org/vuln/gsd-2023-26047 gsd-2023-26047 https://cve.radiocsirt.org/vuln/gsd-2023-26047