RWS WorldServer - Authentication Bypass

An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint. id: CVE-2022-34267 info: name: RWS...

CVE-2024-50849

CVE-2024-50849: Хранимая XSS в WorldServer v11.8.2 Уязвимость хранимого межсайтового скриптинга XSS в функциональности "Rules" WorldServer v11.8.2 позволяет удаленному аутентифицированному злоумышленнику выполнить произвольный JavaScript-код. Аутентифицированный пользователь с высокими привилегия...

CVE-2024-50848

CVE-2024-50848: WorldServer v11.8.2의 XXE 취약점 WorldServer v11.8.2의 Import 객체 및 Translation Memory 가져오기 기능에 존재하는 XML 외부 엔티티XXE 취약점으로 인해, 조작된 .tmx 파일을 제공하여 중요한 시스템 정보에 접근하고 임의 명령을 실행할 수 있습니다. 이 취약점을 악용하려면 인증된 공격자가 기존 시스템 파일이나 디렉터리의 경로가 포함된 악성 페이로드를 담은 .tmx 파일을 제작해야 합니다. 악성 콘텐츠가 포함된 파일을 업로드하면 대상 서버는 ...

EUVD-2023-42174

Malicious code in bioql PyPI...

CVE-2024-50848

An XML External Entity XXE vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive information and execute arbitrary commands via supplying a crafted .tmx file...

CVE-2024-50849

A Stored Cross-Site Scripting XSS vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote authenticated attacker to execute arbitrary JavaScript code...

CVE-2023-38357

Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessions...

CVE-2022-34268

An issue was discovered in RWS WorldServer before 11.7.3. /clientLogin deserializes Java objects without authentication, leading to command execution on the host...

CVE-2022-34269

An issue was discovered in RWS WorldServer before 11.7.3. An authenticated, remote attacker can perform a ws-legacy/loaddtd?systemid= blind SSRF attack to deploy JSP code to the Apache Axis service running on the localhost interface, leading to command execution...

CVE-2022-34270

An issue was discovered in RWS WorldServer before 11.7.3. Regular users can create users with the Administrator role via UserWSUserManager...

CVE-2022-34267

An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint...

CVE-2024-50848

An XML External Entity XXE vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive information and execute arbitrary commands via supplying a crafted .tmx file...

CVE-2024-50849

A Stored Cross-Site Scripting XSS vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote authenticated attacker to execute arbitrary JavaScript code...

CVE-2024-50848

An XML External Entity XXE vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive information and execute arbitrary commands via supplying a crafted .tmx file...

RWS Trados WorldServer 安全漏洞

RWS Trados WorldServer is a flexible, enterprise-class translation management system from RWS. A security vulnerability exists in RWS Trados WorldServer version v11.8.2 that stems from the presence of a cross-site scripting XSS vulnerability that could allow a remote, authenticated attacker to...

RWS WorldServer 安全漏洞

RWS WorldServer is a flexible, enterprise-class translation management system from RWS UK. A security vulnerability exists in RWS WorldServer version v11.8.2, which stems from the presence of an XML External Entity XXE vulnerability that allows an attacker to access sensitive information and...

CVE-2024-50848

An XML External Entity XXE vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive information and execute arbitrary commands via supplying a crafted .tmx file...

CVE-2024-50848

RWS WorldServer v11.8.2 is vulnerable to an XML External Entity (XXE) vulnerability within the Import object and Translation Memory import functionalities. An authenticated attacker can exploit this by supplying a crafted .tmx file containing a malicious payload. This can lead to the disclosure o...

CVE-2024-50848: Improper Restriction of XML External Entity Reference

An XML External Entity XXE vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive information and execute arbitrary commands via supplying a crafted .tmx file...

CVE-2024-50849: Improper Neutralization of Input During Web Page Generation

A Stored Cross-Site Scripting XSS vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote authenticated attacker to execute arbitrary JavaScript code...