weblate@2.8 vulnerabilities

Affected versions of this package are vulnerable to Information Exposure due to a flaw that allows one to log in without credentials after logging out, potentially causing sensitive data exposure.

Upgrade Weblate to version 4.18 or higher.

Affected versions of this package are vulnerable to Insufficient Session Expiration when users may be allowed to modify their password, but the session credentials continue to be operational even after the password has been altered.

Upgrade Weblate to version 2.14 or higher.

Affected versions of this package are vulnerable to Denial of Service (DoS) in weblate/accounts/forms.py.

Upgrade Weblate to version 2.14 or higher.

Affected versions of this package are vulnerable to User Interface (UI) Misrepresentation of Critical Information due to missing checks in the weblate/trans/forms.py file.

Upgrade Weblate to version 2.14 or higher.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) due to insufficient checks in the /trans/views/error.py file.

Upgrade Weblate to version 4.3 or higher.

Affected versions of this package are vulnerable to CSV Injection due to insufficient checks in the weblate/trans/exporters.py endpoint, via the CSV export feature.

Upgrade Weblate to version 2.14 or higher.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization in the Editor Link field.

Upgrade Weblate to version 2.14 or higher.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the weblate/accounts/pipeline.py and weblate/accounts/views.py endpoints, due to missing rate limiting for the 'Remove Account' function.

Note:

This issue can lead to massive mailings.

Upgrade Weblate to version 4.14.2 or higher.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

Upgrade Weblate to version 4.11.1 or higher.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via crafted user and language names.

Upgrade Weblate to version 4.11 or higher.

weblate is a web-based translation tool with tight version control integration The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests.