Weblate: Logging in without knowing credentials after logged out action

A vulnerability was discovered where a user could remain logged in to a website even after logging out, and the next person who accesses the site could be automatically logged in as the previous user without needing their credentials. This could potentially lead to sensitive data exposure and...

Weblate: CSRF with logout action

A vulnerability was discovered in Weblate that allowed a bad actor to log out a user by tricking them into clicking a specially crafted link or button. This vulnerability was caused by a lack of CSRF protection on the logout action...

Weblate: Testing flow includes a DeepSource secret

The testing workflow for the WeblateOrg/wlc repository included a DeepSource secret, which could have allowed a malicious actor to access parts of the repository and report artifacts to DeepSource. The recommended usage would have been to create a GitHub action environment secret and call it at...

SUSE CVE-2017-5537

The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests...

SUSE CVE-2022-24710

Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed i...

Weblate: No rate limiting for Remove Account lead to huge Mass mailings

Name of the vulnerability:- No rate limiting for Remove Account lead to huge Mass mailings Hlw Team I am a security researcher and I found this vulnerability in your website Business Logic Errors https://hosted.weblate.org Description : No Rate Limit is a type of computer security vulnerability...

GHSA-J24G-GM76-J829 Weblate user account enumeration via reset password form

The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests...

Weblate user account enumeration via reset password form

The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests...

weblate parameter injection vulnerability

Weblate is a web-based free software continuous localization system from Copyleft. weblate is vulnerable to a parameter injection vulnerability that results from a lack of filtering and escaping of user-submitted parameters, which can be exploited by attackers to cause command execution...

Command Injection

Weblate is vulnerable to command injection. The vulnerability exists in clone and getremotebranch functions in mercurial.py and git.py respectively because some arguments are not sanitize which allows an attacker to inject and execute arbitrary commands...

Remote Code Execution (RCE)

weblate, is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the checkconfig function in the mercurial.py file allowing a malicious user to execute command via argument injection to crash the system...

GHSA-H2G5-2RHX-FFGJ Duplicate Advisory: Command injection in Weblate

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3872-f48p-pxqj. This link is maintained to preserve external references. Original Description Weblate is a web based localization tool with tight version control integration. Prior to version 4.11.1, Weblate...

Duplicate Advisory: Command injection in Weblate

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3872-f48p-pxqj. This link is maintained to preserve external references. Original Description Weblate is a web based localization tool with tight version control integration. Prior to version 4.11.1, Weblate...

GHSA-3872-F48P-PXQJ Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate

Impact Weblate didn't correctly sanitize some arguments passed to Git and Mercurial, which allowed changing their behavior in an unintended way. Patches The issues were fixed in the 4.11.1 release. The following commits are addressing it: 35d59f1f040541c358cece0a8d4a63183ca919b8...

CVE-2022-23915

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution...

Remote code execution

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution...

PYSEC-2022-31

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution...

PYSEC-2022-31

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution...

CVE-2022-23915 Remote Code Execution (RCE)

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution...

CVE-2022-23915

CVE-2022-23915 affects Weblate versions 0 through 4.11.0, allowing an authenticated user to trigger Remote Code Execution via argument injection when using Git or Mercurial repositories. The root cause is improper handling of arguments passed to VCS commands, enabling unintended behavior and comm...