Weblate: Content Spoofing

Hello Team, Discover a Content Spoofing here: Visit This Link PoC: F179125...

Weblate: Null Password - Setting a new password doesn't check for empty spaces

Hi Again! As seen your website at https://demo.weblate.org/accounts/password/ Your password can't be too similar to your other personal information. Your password must contain at least 6 characters. Your password can't be a commonly used password. Your password can't be entirely numeric. I found...

Weblate: Notify user about password change

Hi, There is an issue with password reset functionality with Weblate: user is not receiving notification when he reset password. Good thing: when user change his info like profile update, password change. User get email notification for password change etc. Issue: user not always gets a...

Weblate: Abuse of Api that causes spamming users and possible DOS due to missing rate limit

Summary: In your sub-domain: http://demo.weblate.org , another endpoint doesn't have any rate limit on it to prevent spamming you by posting a lot of questions. Description: Spamming and Possible DOS is being possible due to missing rate limit on this endpoint. Request POST /accounts/email/...

Weblate: Missing DMARC on weblate.org

Summary Email spoofing is possible due to missing SPF/Dmarc Records. Similar to this report submitted to Hackerone itself: https://hackerone.com/reports/575 Steps to reproduce: 1- Go to https://emkei.cz A Fake Mailer 2- Set the from to parameter as [email protected] or any other name, and send...

Weblate: Abuse of Api that causes spamming users and possible DOS due to missing rate limit on contact form

Summary: In your sub-domain: https://demo.weblate.org/ , there's an endpoint that doesn't have any rate limit on it to prevent spamming you by filling the contact you form multiple times to bomb you with tons of emails. Description: Spamming and Possible DOS is being possible due to missing rate...

Weblate: User Enumeration when adding email to account

It is possible to find all the Register emails which can be use for spam or other purposes csrfmiddlewaretoken token can be used more than one. All Register Email can be found by just brute force attack. Your web endpoint https://demo.weblate.org/accounts/email/ when changing email after login...

Weblate: Existing sessions valid after removing third party auth

Hi team, I noticed an authentication break when logging in with 3rd party credentials in https://hosted.weblate.org/ POC 1 access https://hosted.weblate.org/accounts/profile/auth link to a Google account for example 2 on other device access the same account using Google credentials 3 return to th...

Weblate: Weak e-mail change functionality could lead to account takeover

Hi, Summary I have found a design issue on the e-mail change functionality offered by the "/accounts/profile" handler. In particular, the e-mail change functionality does not require the current user password to be completed. Since the e-mail could be used to reset the password of the account, an...

Weblate: Content Spoofing in error message

Hi Weblate, I found a content spoofing Steps to reproduce 1. Go to https://hosted.weblate.org/translate/debian-reference/translations/fr/?type=Sorry for the inconvenience we where having some trouble in our system because of some hackers, please don't log in for you to make safe of your credentia...

Weblate: Missing restriction on string size of Full Name at https://demo.weblate.org/accounts/register/

Hi there Vulnerability Title: During my regular testing, I have found that there was no restriction on the amount of text that can be inserted into a user's Full name field. Security Impact: When the text size was large enough the service resulting in a momentary outage in our non-production...

Weblate: Open SMTP port can let anyone send email from mail.chihar.com

An open SMTP port 587 can let anyone connect and send emails impersonating someone in your the company if he could enumerate the email addresses. POC - 1. I performed an nmap scan and was able to find an open port 587 for SMTP 2. I did a netcat connection to it and was able to run commands such a...

Weblate: Login using disconnected google account i.e login using old email id

there is vulnerability that allows loggin in using old email id i.e a disconnected google account attack scenario: 1: attacker has compromised google id of user 2:now user notices this and changes email id and removes previous authentication 3:but still attacker can login using disconnected googl...

Weblate: Open port leads to information disclosure

Open port 10022 leads to disclosure of open-ssh version and current Debian version being used. POC- 1. I performed an nmap scan nmap -A -T4 -p- weblate.org 2. I saw the port 10022 was open and I did a telnet connect to the port. 3. As soon as I did the telnet connect it returned me the openssh...

Weblate: hosted.weblate.org: X-XSS-Protection not enabled

Hi, X-Xss-Protection @https://hosted.weblate.org/ has not been set. This header is used to configure the built in reflective XSS protection found in Internet Explorer, Chrome and Safari Webkit. Valid settings for the header are 0, which disables the protection, 1 which enables the protection and ...

Weblate: Directory Listing

Proof Of Concept Navigate this domain: https://hg.weblate.org Some information Disclosure: https://hg.weblate.org/sumwars/Changelog.txt https://hg.weblate.org/kallithea-stable/Apache-License-2.0.txt Some software verison Thanks,...

Weblate: You can simply just use passwords that simply are as 123456

This may not be a issue but is a flaw for many websites because passwords should contain letters and characters like - and much more. Uppercase, lowcase. as it makes it much more secure it will be acceptable. this might scare your customers away feeling unsecure...

Weblate: CSRF - Changing the full name / adding a secondary email identity of an account via a GET request

SUMMARY ---------- Hello, I have found a CSRF request via the activation email that will change the full name of the targeted account. This vulnerability exists if the attacker registers a new account and then gives his activation link to someone else. If the victim uses the received activation...

Weblate: Improper Password Reset Policy on https://hosted.weblate.org/

Application should not allow the user to set the last 3-5 password in terms of secure design principles. It should give a warning or provide such avoidance while user is using repetitive usage of passwords. Repro: 1. Try to set same old password via Password Reset link. Fix: Application should...

Weblate: Insecure Account Removal

Hi Team, The removal of account is one of the sensitive part of a web application that needs to protect, therefor removing an account should validate the authenticity of the legitimate user, however i have found that when removing an account, the system did not require the user to input the accou...