916 matches found
Weblate: CSP "script-src" includes "unsafe-inline" in weblate.org and demo.weblate.org
Weblate is using unsafe-inline in script-src csp headers which allows the use of inline resources, such as inline elements, javascript: URLs, inline event handlers, and inline elements. POC: HTTP/1.1 200 OK Server: nginx Date: Tue, 23 May 2017 10:49:15 GMT Content-Type: text/html; charset=utf-8...
Weblate: CSRF bypass ( Delate Source Translation From dictionaries ) in demo.weblate.org
Hello I've Found CSRF in https://demo.weblate.org Sending a POST request dictionaries will delate successfully steps to reproduce: 1. go https://demo.weblate.org/ and login into your account 2. now go https://demo.weblate.org/dictionaries/hello/sl/ 3. add new word, now delate it by CSRF i made tw...
Weblate: Weblate |Security Misconfiguration| Method Enumeration Possible on domain
Hi Team, I have found an instance in application where application is alllowing OPTIONS method to be processed in HTTP request from weblate.org and in response to my request i got the information that these methods are allowed by application server "GET, HEAD, OPTIONS" Ideally server should not...
Weblate: Weblate- Banner Grabbing-Ngnix Server version
Hey, I have found in the HTTP response header from docs.weblate.org, the nginx web server version is disclosed. Ideally application server responds back to users error message in customzied manner by not revealing any sensitive information about webserver or underlying components in applicatio...
Weblate: Option method enabled
Description HTTP OPTIONS method is enabled. Affected URL : https://demo.weblate.org/ https://weblate.org/en/ https://hosted.weblate.org PoC curl -X OPTIONS https://hosted.weblate.org -vv Output aku@galau:$ curl -X OPTIONS https://hosted.weblate.org -vv Rebuilt URL to: https://hosted.weblate.org/...
Weblate: Takeover of an account via reset password options after removing the account
Hi, The Reset password mechanism can't validate or authenticate an user properly. After removing a user account it's possible to takeover the user account by using reset password option. which is turn into takeover an account. Step to Reproduce: 1. Go to weblate 2. Remove your account from weblat...
Weblate: Password token validation in https://demo.weblate.org/
Hi team, I noticed that when requesting multiple reset links at https://demo.weblate.org/ all tokens are valid and can be used. In numerous applications the following policy is adopted as an additional security measure: - keep valid only that token with shorter lifetime last requested or -...
Weblate: Password Restriction
Hi Weblate, Hope you all have a good day! Its a minor issue, but hope you'll fix it. It seems like after changing password for example my current password is : mypassword1 And lets assume that the hacker got an access to my account, and me of course will change my password to ex. mypassword2...
Weblate: No notificatoin sent on email after account deletion.
Hi again, Description: As I reported in previous report about account deletion about without entering password 229904 I've just noticed that there's no email notification received after successfully removal of account. Fixation: User should be notified by email notification at his email after...
Weblate: Adding Email lacks Password validation
Affected URL: https://demo.weblate.org/accounts/email/ Issue: The account section of profile says: "You can add another email address on the Authentication tab." But there is no option of adding another email in Authentication. However, I was able to guess the above endpoint. The problem here is,...
Weblate: Rate Limit Issue on hosted.weblate.org
Hi, Rate limit issue exist in hosted.weblate.org. An attacker can able to send as many email as he want to the victim mail. The attacker can successfully bruteforce on any users mail account even when the rate limiting is enabled. Step to reproduce : 1. sign up and login to a hosted.weblate.org 2...
Weblate: Missing restriction on string size
Affected URL: https://demo.weblate.org/contact/?t=account Issue: I have found an issue similar to 223454. There is no restriction to number of character that can be send as email, username and other field. If any more information is needed feel free to contact me...
Weblate: Self-XSS can be achieved in the editor link using filter bypass
Description I saw the fixed issue in the https://hackerone.com/reports/223692 and i think i found another filter bypass. I noticed that we actually can use special keywords like %branchs, %files and %lines. So XSS can be achieved in this way: %branchs:alert1;//https:// if the branch will be named...
Weblate: Information Disclosure on demo.weblate.org
Description The demo instance, located on https://demo.weblate.org is leaking user's IP-adresses in the Activity log. F185728 Impact The authenticated user can disclose valid IP adresses of other users through Activity log. The feature works as it should so no changes should be made on the GitHub...
Weblate: Captcha bypass at registration
Affected URL: https://demo.weblate.org/accounts/register/ Issue: The captchas are implement so that the site can differentiate between the legitimate user and the bot. The captcha challenge should be something that a bot cannot solve easily and a human could easily solve. However, in the above UR...
Weblate: Old password can be new password
Affected Domain: https://demo.weblate.org/ Issue: The sites like Facebook and Google keeps tracks of old password and does not allow user to set password similar to their old passwords. However in case of demo.weblate.org. It is possible for a user to set new password which is exactly similar to...
Weblate: Captcha Bypass at Email Reset can lead to Spamming users.
Because of 223525 you've implemented captcha on Reset Email functionality. But it can be bypassed and any attacker can flood/spam victim with reset emails in his Email Inbox...
Weblate: Login CSRF : Login Authentication Flaw
Hi Team, Domain: demo.weblate.org In this bug, i have found a way to login any person to the attackers account, therefor when any user login to attackers account, the attacker can see the victims activity inside attackers account such as sensitive information. The issue relies on registration...
Weblate: No Rate Limiting at /contact
Hi Weblate Security Team, How are you? Hope you all have a good day and doing well just like me. : I've found a No Rate Limiting in contact directory of your site because there is no mitigation in there like adding a captcha, In this case the attacker can spam you...