62 matches found
RWS WorldServer - Authentication Bypass
An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint. id: CVE-2022-34267 info: name: RWS...
CVE-2024-50849
CVE-2024-50849: Stored XSS in the WorldServer v11.8.2 A Stored Cross-Site Scripting XSS vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote authenticated attacker to execute arbitrary JavaScript code. An authenticated high-privileged user must go to the "Rules" page...
CVE-2024-50848
CVE-2024-50848: XXE in the WorldServer v11.8.2 An XML External Entity XXE vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 might lead to access sensitive system information and execute arbitrary commands via supplying a crafted .tmx file. To...
EUVD-2023-42174
Malicious code in bioql PyPI...
CVE-2024-50848
An XML External Entity XXE vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive information and execute arbitrary commands via supplying a crafted .tmx file...
CVE-2024-50849
A Stored Cross-Site Scripting XSS vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote authenticated attacker to execute arbitrary JavaScript code...
CVE-2023-38357
Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessions...
CVE-2022-34268
An issue was discovered in RWS WorldServer before 11.7.3. /clientLogin deserializes Java objects without authentication, leading to command execution on the host...
CVE-2022-34269
An issue was discovered in RWS WorldServer before 11.7.3. An authenticated, remote attacker can perform a ws-legacy/loaddtd?systemid= blind SSRF attack to deploy JSP code to the Apache Axis service running on the localhost interface, leading to command execution...
CVE-2022-34270
An issue was discovered in RWS WorldServer before 11.7.3. Regular users can create users with the Administrator role via UserWSUserManager...
CVE-2022-34267
An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint...
CVE-2024-50848
An XML External Entity XXE vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive information and execute arbitrary commands via supplying a crafted .tmx file...
CVE-2024-50849
A Stored Cross-Site Scripting XSS vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote authenticated attacker to execute arbitrary JavaScript code...
CVE-2024-50848
An XML External Entity XXE vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive information and execute arbitrary commands via supplying a crafted .tmx file...
CVE-2024-50848
CVE-2024-50848 : Multiple sources confirm an XML External Entity (XXE) vulnerability in the WorldServer v11.8.2 Import object and Translation Memory import features, exploitable by supplying a crafted .tmx file. Affected component: WorldServer 11.8.2; root cause: XXE allowing access to sensitive ...
RWS WorldServer 安全漏洞
RWS WorldServer is a flexible, enterprise-class translation management system from RWS UK. A security vulnerability exists in RWS WorldServer version v11.8.2, which stems from the presence of an XML External Entity XXE vulnerability that allows an attacker to access sensitive information and...
CVE-2024-50848
An XML External Entity XXE vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive information and execute arbitrary commands via supplying a crafted .tmx file...
RWS Trados WorldServer 安全漏洞
RWS Trados WorldServer is a flexible, enterprise-class translation management system from RWS. A security vulnerability exists in RWS Trados WorldServer version v11.8.2 that stems from the presence of a cross-site scripting XSS vulnerability that could allow a remote, authenticated attacker to...
PT-2024-34444 · Unknown · Worldserver
Name of the Vulnerable Software and Affected Versions: WorldServer version 11.8.2 Description: A Stored Cross-Site Scripting XSS issue in the "Rules" functionality allows a remote authenticated attacker to execute arbitrary JavaScript code. Recommendations: For WorldServer version 11.8.2, at the...