Weblate: No expiration of session ID after Password change

If an user changes his password, the session persists and new session ID won't be created. POC - 1. Make any request and capture it using any proxy burp 2. Go to account settings and change the password. 3. Replay the captured request by changing any parameterusername or fullname 4. You get a...

Weblate: Open Redirect via "next" parameter in third-party authentication

Hi, It is currently possible to execute an open redirection attack via the next parameter with the inclusion of a triple-slash prefix. Proof of Concept Redirect URL https://demo.weblate.org/accounts/login/github/?next=///google.com After authenticating, the user will be immediately redirected to...

Weblate: Registration captcha bypass

Hello, I've found that it is possible to bypass captcha during registration. Attacker can automatize registration process and create multiple accounts. Here are steps to reproduce: 1. Go to registration page. Type information and catch request in proxy. 2. Get correct answer for captcha and captc...

Weblate < 2.10.1 Information Disclosure Vulnerability

Weblate is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:weblate:weblate"; if...

Weblate Detection (HTTP)

HTTP based detection of Weblate. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.106667";...

CVE-2017-5537

The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests...

Design/Logic Flaw

The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests...

PYSEC-2017-42

The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests...

CVE-2017-5537

The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests...

PYSEC-2017-42

The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests...

CVE-2017-5537

The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests...

CVE-2017-5537

CVE-2017-5537 affects Weblate prior to 2.10.1, where the password reset form returns different error messages based on whether the provided email is linked to an account. This behavior enables remote user enumeration via multiple requests. Public reports across multiple sources (SÚSE, OSV, GHSA a...

Weblate Information Disclosure Vulnerability

Weblate is a free web-based translation management system. It can be tightly integrated with version control. It features a clean and simple user interface, translation synchronization between components, quality checking and automatic linking to source files. Weblate suffers from an information...

Information Disclosure In Password Reset Form

weblate is vulnerable to information disclosure in its password reset form. When entering an arbitrary email address in the password reset form, it will report back "User with this email address was not found", allowing to figure out which user accounts exist on the weblate instance...