916 matches found
Weblate: Open port leads to information disclosure
Open port 10022 leads to disclosure of open-ssh version and current Debian version being used. POC- 1. I performed an nmap scan nmap -A -T4 -p- weblate.org 2. I saw the port 10022 was open and I did a telnet connect to the port. 3. As soon as I did the telnet connect it returned me the openssh...
Weblate: hosted.weblate.org: X-XSS-Protection not enabled
Hi, X-Xss-Protection @https://hosted.weblate.org/ has not been set. This header is used to configure the built in reflective XSS protection found in Internet Explorer, Chrome and Safari Webkit. Valid settings for the header are 0, which disables the protection, 1 which enables the protection and ...
Weblate: Directory Listing
Proof Of Concept Navigate this domain: https://hg.weblate.org Some information Disclosure: https://hg.weblate.org/sumwars/Changelog.txt https://hg.weblate.org/kallithea-stable/Apache-License-2.0.txt Some software verison Thanks,...
Weblate: You can simply just use passwords that simply are as 123456
This may not be a issue but is a flaw for many websites because passwords should contain letters and characters like - and much more. Uppercase, lowcase. as it makes it much more secure it will be acceptable. this might scare your customers away feeling unsecure...
Weblate: CSRF - Changing the full name / adding a secondary email identity of an account via a GET request
SUMMARY ---------- Hello, I have found a CSRF request via the activation email that will change the full name of the targeted account. This vulnerability exists if the attacker registers a new account and then gives his activation link to someone else. If the victim uses the received activation...
Weblate: Improper Password Reset Policy on https://hosted.weblate.org/
Application should not allow the user to set the last 3-5 password in terms of secure design principles. It should give a warning or provide such avoidance while user is using repetitive usage of passwords. Repro: 1. Try to set same old password via Password Reset link. Fix: Application should...
Weblate: Insecure Account Removal
Hi Team, The removal of account is one of the sensitive part of a web application that needs to protect, therefor removing an account should validate the authenticity of the legitimate user, however i have found that when removing an account, the system did not require the user to input the accou...
Weblate: CSRF : Lock and Unlock Translation
Description : Attacker can force to victim for Lock and Unlock Translation. That HTTP Request : GET /lock/aptoide-uploader/strings/ka/ HTTP/1.1 Host: hosted.weblate.org Connection: close Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10123 AppleWebKit/537.36 KHTML,...
Weblate: CSV Injection with the CSV export feature
Step to reproduce : 1.go to https://hosted.weblate.org/dictionaries/aptoide-uploader/bn/add 2.add "=1+1" to Source and Translation filed F178723 3.now do CSV export 4.you can see all the cell is displayed as "2" which means the code is executed. Best Regad's, Jay Patel...
Weblate: Already Registered Email Disclosure
Hello, In the registration at https://hosted.weblate.org/accounts/register/ , I found that trying an already used email would inform the register that you are trying used one, so with a dictionary of emails a hacker can determine the emails of all users in database and use that in phishing. Note:...
Weblate: Activation tokens are not expiring
Hi Team, Domain: demo.weblate.org In this bug, maybe it is low risk but i have found a way to login any person to the attackers account, therefor when any user login to attackers account, the attacker can see the users activity on attackers account. The issue relies on the password reset. Stes to...
Weblate: CSRF : Reset API
Description : Attacker can force to victim for reset his API. That HTTP Request : GET /accounts/reset-api-key/ HTTP/1.1 Host: hosted.weblate.org Connection: close Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10123 AppleWebKit/537.36 KHTML, like Gecko...
Weblate: [demo.weblate.org] Stored Self-XSS via Editor Link in Profile
Hi, Input validation and/or sanitisation is not currently applied to the "Editor Link" in the user's Preferences. Consequently, it is possible to store a JavaScript payload which is stored and executes in the Weblate instance context. F178717 Steps to reproduce 1. Visit the above Preferences page...
Weblate: No expiration of session ID after Password change
If an user changes his password, the session persists and new session ID won't be created. POC - 1. Make any request and capture it using any proxy burp 2. Go to account settings and change the password. 3. Replay the captured request by changing any parameterusername or fullname 4. You get a...
Weblate: Open Redirect via "next" parameter in third-party authentication
Hi, It is currently possible to execute an open redirection attack via the next parameter with the inclusion of a triple-slash prefix. Proof of Concept Redirect URL https://demo.weblate.org/accounts/login/github/?next=///google.com After authenticating, the user will be immediately redirected to...
Weblate: Registration captcha bypass
Hello, I've found that it is possible to bypass captcha during registration. Attacker can automatize registration process and create multiple accounts. Here are steps to reproduce: 1. Go to registration page. Type information and catch request in proxy. 2. Get correct answer for captcha and captc...
WS-2017-3790
In Weblate in versions 2.0 to 2.13 it may allows to a user to change his password and the session credentials are still in use even after password change...
WS-2017-3796
In weblate in versions weblate-2.5 to weblate-2.13.1 is vulnerable to error message that could be confusing and as we're using GET here, the URL and thus type parameter might be crafted by third party in weblate/trans/forms.py...