916 matches found
Weblate: Open Github Repo Leaking WEBLATE SECRET KEY
Team, While going through Github search I discovered a public repository which contains Weblate Secret Key Issue & Poc: Repo: https://github.com/WeblateOrg File:https://github.com/WeblateOrg/weblate/blob/592472958f7b847701c51b36f4768b9784219fa1/weblate/settingsdocker.py SECRETKEY = os.environ.get...
Weblate: HTML injection and information disclosure in support panel
Hello Weblate Team! I found HTML injection and information disclosure in support panel Description There is a form to weblate.org and hosted.weblate.org to send to support I poisoned the request, where I inserted such payload in all fields: " After that, when my payload got into the support panel...
Weblate: Stored XSS via Create Project (Add new translation project)
Hi, Input validation and/or sanitisation is not currently applied in the Project Name field in https:///create/project/. As, a result, it is possible to have a stored XSS that will affect all the users in the Weblate application. To identify this XSS I used the Docker environment from...
Weblate: No Rate On Add Suggest
Hello Description : I have found that there is no limit in the number of requests in place of adding suggest, which may exploit the vulnerability of the attacker to send a large number of suggestions, for example, send a million suggest may lead to cause a problem to the server Steps To Reproduce...
Weblate: No Rate Limit On Add new word
Hello I found in that there is no limit in the place of adding a new word which allows the attacker to add an infinite number of words which may cause a problem in the site and the server Steps To Reproduce : 1. Go To https://hosted.weblate.org/dictionaries/andors-trail/en/add And Fill in fields...
Weblate: Stored XSS @ /engage/<project_slug>
Description The vulnerability concerns a Stored XSS, while it is currently to the best of my knowledge not exploitable due to limitations stated below. I thought that the issue is worth reporting anyway. Steps to reproduce 1. Change a project's name or create one to the following payload:...
Weblate: 2nd issue>>> flood of email no rate limit on delete account confirmation email >>
There was no rate limit on delete account confirmation email, leading to user being able to send himself flood of emails...
Weblate: flood of comment no rate limit on commnets >> by using different user agent
It was possible to post 200- 300 of comments within minutes, there was no rate limiting applied...
Weblate: Broken Authentication – Session Token bug
I found a broken authentitication vuln POC: 1- Create a https://demo.weblate.org/accounts/profile/ account 2- Confirm your email 3- Now request a password reset for your account. 4- Don’t use the password reset link that was sent to your email. 5- Login to your account, remember don’t use first t...
Weblate: Browser Self XSS Protection not implemented
Hi Self XSS Protection not used ,An attacker can trick users to insert JavaScript in browser console. A Self-XSS scam usually works by promising to help you access somebody else's account. Instead, the scammer tricks you into gaining access to your account for fraud, spam and tricking more people...
Weblate: Audit log validation
Issue For the docker image git clone https://github.com/WeblateOrg/docker.git weblate-docker, the IP address in the audit log in the user's profile, and in the administration console can be forged using the X-Forwarded-For header during the login process. This does not affect...
Weblate: no notification send to victim if attacker hacks/accesses his victims WebLate account.
hello team, when a hacker hacks into his victims WebLate account, the victim does not get any notifications. via email for example this means that the victim therefore won't take action to change his password for example in order to secure his account. Risk: very, very dangerous a hacker can now ...
Weblate: Improper validation of unicode characters#2
It was reported that some Unicode chars cause Weblate to crash. Upon further investigation it has shown that the issue was unrelated to Unicode. The reported was just unlucky to perform testing while there was temporary error on the database...
Weblate: Improper validation of unicode characters
unicode characters are not properly being validated on the https://demo.weblate.org/accounts/profile/preferences in specical character Screenshot showing this is attached below...
Weblate: Account Restore / Reactivating an old email via old reset link
Hi, I noticed you now send a confirmation link after loading the reset link, below is a screenshot showing the email and highlighting the error. F227060 Best Regards, @footstep...
Weblate: Add another email address without verification
Introduction In the normal case, to link another email address to the Weblate account, users need to own the email address and click the verification link. However, I found an issue, that allows adding another email address without clicking on the verification link. Description and PoC: Create a...
Weblate: Application allowing old password to be set as new password | hosted.weblate.org
Hi Team, I found an issue that your application is allowing user to set new password same as that of the old password. Steps to reproduce the defect -Firstly logged into the application with existing password refer screenshot named : Original Password login Request-Old password highlighted in...
Weblate: No rate limit or captcha to identify humans
Affected URL: https://hosted.weblate.org/hosting/ Issue: There is no captcha or rate limit to protect from bots against adding request for new project hosting. Which makes it easy for an attacker to perform spamming. Shall you need any more info notify me,...
Weblate: Missing Restriction On String Size
Similar to 223454, there is no string size restriction on project parameter which is sent directly to the server. URL: https://hosted.weblate.org/hosting/ PoC: poc1.png and poc2.png Shall you need any more info notify me,...