CVE-2022-34267

Summary: RWS WorldServer before 11.7.3 contains an authentication bypass. By adding a token parameter with value 02, an attacker can bypass all auth requirements and upload/execute arbitrary Java code via a .jar archive at the ws-api/v2/customizations/api endpoint. Impact: unauthenticated code ex...

CVE-2023-38357

CVE-2023-38357 affects RWS WorldServer up to version 11.7.3, where session tokens have low entropy and can be enumerated, potentially granting unauthorized access to user sessions. Affected component is the session handling/token generation. The exploitation involves token enumeration leading to ...

CVE-2024-50849

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Rules functionality of WorldServer v11.8.2 . A remote authenticated attacker with high privileges can execute arbitrary JavaScript by entering an XSS payload into the rule name and parameter subject fields. The attack is triggered af...

CVE-2024-50848

RWS WorldServer v11.8.2 is vulnerable to an XML External Entity (XXE) vulnerability within the Import object and Translation Memory import functionalities. An authenticated attacker can exploit this by supplying a crafted .tmx file containing a malicious payload. This can lead to the disclosure o...

CVE-2022-34268

CVE-2022-34268 : RWS WorldServer prior to 11.7.3 contains an insecure deserialization flaw in the /clientLogin endpoint, allowing deserialized Java objects without authentication and resulting in command execution on the host. Affected products/versions: RWS WorldServer before 11.7.3. Impact: hig...

CVE-2022-34270

RWS WorldServer versions prior to 11.7.3 are affected by a design/logic flaw (CWE-284) that allows for improper access control . Specifically, regular users can exploit the UserWSUserManager component to create new users with the Administrator role, leading to unauthorized elevation of privileges...

CVE-2022-34269

An authenticated, remote attacker can exploit a blind SSRF vulnerability in RWS WorldServer versions prior to 11.7.3 . By utilizing the ws-legacy/load_dtd?system_id= endpoint, the attacker can deploy JSP code to the Apache Axis service running on the localhost interface, which can result in comma...