CVE-2022-23915 Remote Code Execution (RCE)

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution...

CVE-2022-23915

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution...

PYSEC-2022-162

Weblate is a web based localization tool with tight version control integration. Prior to version 4.11.1, Weblate didn't properly sanitize some arguments passed to Git and Mercurial, allowing them to change their behavior in an unintended way. Instances where untrusted users cannot create new...

PYSEC-2022-162

Weblate is a web based localization tool with tight version control integration. Prior to version 4.11.1, Weblate didn't properly sanitize some arguments passed to Git and Mercurial, allowing them to change their behavior in an unintended way. Instances where untrusted users cannot create new...

PT-2022-16834 · Weblate · Weblate

Name of the Vulnerable Software and Affected Versions: Weblate versions prior to 4.11.1 Description: Weblate is a web-based localization tool with tight version control integration. Prior to version 4.11.1, Weblate didn't properly sanitize some arguments passed to Git and Mercurial, allowing them...

Weblate 参数注入漏洞

Weblate is a web-based free software continuous localization system from Copyleft. weblate is vulnerable to a parameter injection vulnerability that results from a lack of filtering and escaping of user-submitted parameters, which can be exploited by attackers to cause command execution...

Remote Code Execution (RCE)

Overview Affected versions of this package are vulnerable to Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution. PoC 1 login into the...

Weblate Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in Weblate, a Copyleft web-based free software continuous localization system, which stems from the failure of versions prior to 4.11 to properly neutralize user input used in the username and language fields. As a result of this improper neutralization...

Cross-site Scripting (XSS)

weblate is vulnerable to cross-site scripting. An attacker is able to inject malicious script via user name and language parameters because user inputs were not escaped...

Cross-site Scripting in Weblate

Impact Due to improper neutralization, it was possible to perform cross-site scripting via crafted user and language names. Patches The issues were fixed in the 4.11 release. The following commits are addressing it: f6753a1a1c63fade6ad418fbda827c6750ab0bda 9e19a8414337692cc90da2a91c9af5420f2952f1...

GHSA-6JP6-9RF9-GC66 Cross-site Scripting in Weblate

Impact Due to improper neutralization, it was possible to perform cross-site scripting via crafted user and language names. Patches The issues were fixed in the 4.11 release. The following commits are addressing it: f6753a1a1c63fade6ad418fbda827c6750ab0bda 9e19a8414337692cc90da2a91c9af5420f2952f1...

CVE-2022-24710

Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed i...

Cross site scripting

Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed i...

PYSEC-2022-35

Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed i...

PYSEC-2022-35

Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed i...

CVE-2022-24710 Cross-site Scripting in Weblate

Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed i...

CVE-2022-24710

Weblate (WeblateOrg/weblate) is affected by CVE-2022-24710. Versions before 4.11 fail to properly neutralize user input in the username and language fields, enabling cross-site scripting via these fields. The issue was fixed in the 4.11 release; users unable to upgrade are advised to implement th...

CVE-2022-24710 Cross-site Scripting in Weblate

Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed i...

Weblate 跨站脚本漏洞

A cross-site scripting vulnerability exists in Weblate, a Copyleft web-based free software continuous localization system, which stems from the failure of versions prior to 4.11 to properly neutralize user input used in the username and language fields. As a result of this improper neutralization...

Weblate: hosted.weblate.org display of unfiltered results

able to request all changes of everything not just sandbox when inserting this %'s in author username on this page. https://hosted.weblate.org/changes/?project=sandbox&lang=en&user=%25%27s&startdate=&enddate= Impact no filter on request feels like elevated permissions. lets you do the search even...