Weblate: No rate limit or captcha to identify humans

Affected URL: https://hosted.weblate.org/hosting/ Issue: There is no captcha or rate limit to protect from bots against adding request for new project hosting. Which makes it easy for an attacker to perform spamming. Shall you need any more info notify me,...

Weblate: Missing Restriction On String Size

Similar to 223454, there is no string size restriction on project parameter which is sent directly to the server. URL: https://hosted.weblate.org/hosting/ PoC: poc1.png and poc2.png Shall you need any more info notify me,...

Weblate: [debian.weblate.org]-Missing SPF Record

Reproduction Details: dig txt debian.weblate.org|grep "v=spf1"...

Weblate: Reset password more than once with a reset link #2

Sequel to the fix on 243594, this is still possible. Reproduction Steps 1. Request password reset - Load the link in email and set a new password - Navigate to https://demo.weblate.org/accounts/reset/ - Fill the email and captcha - You'll be prompted to enter a new password NOTE: I figured that i...

Weblate: Running 2 accounts with a single email #3

Following the fixes: 241608 & 224072. there's still another way round this. Reproduction Steps 1. Register 2 accounts Preferably using Gmail not third party - Login both accounts on separate browsers - In Browser1, navigate to https://demo.weblate.org/accounts/profile/auth - Add a new association...

Weblate: Password token validation in Weblate Bypass #2

Hi, I also found the bypass to 229987 and 243842. Reproduction Steps: 1. Add multiple emails to an account 2. Request password reset for all emails 3. Use the link in each to make the change 4. All link works! Shuaib...

Weblate: Password token validation in Weblate Bypass

Hi, This is a bypass of the fix on 229987. I could confirm that old link still works. Though you would need to use 2 browsers to pull this off Reproduction Steps 1. In Browser1, request a password reset - Load link sent to your email in the same browser - Request another password reset in Browser...

Weblate: Improper validation of unicode characters #3

Hi! This issue also exists at Translations. Link: https://demo.weblate.org/translate/hello/master/gl/?type=all Screenshots F197895 F197896 Shuaib...

Weblate: No Rate Limitation on Regenerate Api Key

Hi, I discovered that there is no request throttling or limit on api key regeneration. Though theres a little change while making a total of 30 requests in a few seconds, server error occurred then it continued. Screenshot F197872 In the screenshot 685 denotes a processed request and 6052 denotes...

Weblate: Previous password could set as new password

Hi As resolved in 229577, I could still confirm this works. A previously set password could be set as a new one. Shuaib...

Weblate: Improper validation of unicode characters still not fixed #2

As resolved in 229483, I can't see a fix in the Full name field. The issue persists. Though this time it shows the decoded character on the error page but its not saved. Screenshot showing this is attached below. F197856 F197857 Shuaib...

Weblate: Reset password more than once with a reset link

Hi, Though passwords reset links cannot be used more than once but I found a case where one could do so. Reproduction Steps 1. Request a Password Reset on demo.weblate.org 2. Click the reset link in email 3. Enter a new password 4. Click Set my password 5. Then you'll be redirected to the login...

Weblate: No filteration of null characters in name field

Hello, Description: The account settings page, https://demo.weblate.org/accounts/profile/account, allows a user to set their username as a null character! A user intercepts the request using a proxy and changes the user name field to %00. Mitigation: I recommend you have filtering of null...

Weblate: Improper validation of unicode characters

Hi, I just saw a report of 229483 This issue still persist. When i tried some Unicode characters like smilies etc. It is working perfectly by displaying the Error message on the same page that Username may only contain letters, numbers or the following characters: @ . + - See 1.jpg for smilies...

Weblate: Persistence of Third Party Association.

After one might have disconnected a third party association, Google in this case. Using the third party login logs one back in the account...

Weblate: Running 2 accounts with a single email [Part 2]

Following the fix on 224072, I decided to try this in another way and it worked! Reproduction Steps 1. Login with Github on Browser1 and set a password to it. - With another email, signup on Weblate on Browser2 - In the new account on Browser2, do the following: Confirm email and Set a Password A...

Weblate: Full Name Overwrite on Third party login

Description After one might have logged in on a browser using the Third party login Google and have made changes to the account like the Full name. Making a third party login on another browser using the same email overwrites the Full name to the name on the email. One would know he is logged in...

Weblate: Improper validation of unicode characters still not fixed

As opposed to the fix on 229483, unicode characters are not still properly being validated on the username field. Screenshot showing this is attached below. Shuaib...

Weblate: Open redirect while disconnecting Email

Hi team, there is a open redirect end point when any account owner disconnect email accounts. He is redirected to some other domain. Vulnerable URL https://demo.weblate.org/accounts/disconnect/email/2354/?next=http://google.com POC Steps: Go to authentication tab. Disconnect Email account and...

Weblate: no captcha for register user and weak question attacker can spam email

hi in https://demo.weblate.org/accounts/register/ attacker can register with same email and if didnt click on confirm link attacker can make request with infinite loop so attacker can spam another email with your service question is so simple any bot that can read source can generate answer for i...