weblate

vulnerable: 1.9 ... 2.9 (12 versions)

The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests.

vulnerable: 1.9 ... 4.9.1 (86 versions)

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended wa…

vulnerable: 1.9 ... 4.9.1 (85 versions)

Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cros…

vulnerable: 4.14 ... 5.6.1 (35 versions)

Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file. Th…

vulnerable: 1.9 ... 5.9.2 (143 versions)

Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL specified in settings, this URL is included in the client's URL parameters duri…

vulnerable: 1.9 ... 5.9.dev0 (148 versions)

Weblate is a web based localization tool. Prior to version 5.12, the verification of the second factor was not subject to rate limiting. The absence of rate limiting on the second factor endpoint allows an attacker with valid credentials t…

vulnerable: 1.9 ... 5.9.dev0 (148 versions)

Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters. This issue ha…

vulnerable: 1.9 ... 5.9.dev0 (151 versions)

Weblate is a web based localization tool. Versions lower than 5.13.1 contain a vulnerability that causes long session expiry during the second factor verification. The long session expiry could be used to circumvent rate limiting of the s…

vulnerable: 1.9 ... 5.9.dev0 (155 versions)

Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, …

vulnerable: 1.9 ... 5.9.dev0 (158 versions)

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to accept an invitation opened by a different user. Version 5.15. contains a patch. As a workaround, avoid leaving one's Weblate sessions with an invitati…

vulnerable: 1.9 ... 5.9.2 (157 versions)

Weblate has a Server-Side Request Forgery issue ### Impact The Create Component functionality in Weblate allows authorized users to add new translation components by specifying both a version control system and a source code repository UR…

vulnerable: 1.9 ... 5.9.2 (157 versions)

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version 5.15 fixes the issue.

vulnerable: 1.9 ... 5.9.2 (158 versions)

Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to read arbitrary files from the server file system using crafted symbolic links in the repository. Version 5.15.1 fixes the issue.

vulnerable: 1.9 ... 5.9.2 (163 versions)

Weblate is a web based localization tool. In versions prior to 5.17, the tasks API didn't verify user access for pending tasks. This could expose logs of in-progress operations to users who don't have access to given scope. The attacker ne…

vulnerable: 1.9 ... 5.9.2 (163 versions)

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't enforce proper access control. This issue has been fixed in version 5.17. If users are unabl…

vulnerable: 1.9 ... 5.9.2 (163 versions)

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't perform proper access control. This issue has been fixed in version 5.17. If developers are …

vulnerable: 1.9 ... 5.9.2 (163 versions)

Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in…

vulnerable: 1.9 ... 5.9.2 (163 versions)

Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting applied only to the first issued requests and didn't restrict possible redirects. This issue has been fixed in version 5.17.

vulnerable: 1.9 ... 5.9.2 (163 versions)

Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17.

vulnerable: 1.9 ... 5.9.2 (163 versions)

Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal n…

vulnerable: 1.9 ... 5.9.2 (163 versions)

Weblate is a web based localization tool. In versions prior to 5.17, the user patching API endpoint didn't properly limit the scope of edits. This issue has been fixed in version 5.17.

vulnerable: 1.9 ... 5.9.2 (163 versions)

Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable …

vulnerable: 1.9 ... 5.9.2 (163 versions)

Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root pa…

vulnerable: 1.9 ... 5.9.2 (164 versions)

Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions are correctly invalidated via "cycle_session_keys()", but DRF API tokens ("wlu_*" prefix) stored in "authtoken_token" a…

vulnerable: 1.9 ... 5.9.2 (164 versions)

Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup…

vulnerable: 1.9 ... 5.9.2 (164 versions)

Weblate is a web based localization tool. Prior to version 5.17.1, the screenshots, tasks, and component link API allowed for the enumeration of translations in a project inaccessible to the user. This issue has been patched in version 5.1…

vulnerable: 1.9 ... 5.9.2 (164 versions)

Weblate is a web based localization tool. Prior to version 5.17.1, the Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes. This issue has been patched in version 5.17.1.