Worldserver
Rws · 7 CVEs
A Stored Cross-Site Scripting (XSS) vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote a…
Nov 18, 2024
An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldS…
Nov 18, 2024
An issue was discovered in RWS WorldServer before 11.7.3. Regular users can create users with the Administrator role vi…
Dec 25, 2023
An issue was discovered in RWS WorldServer before 11.7.3. An authenticated, remote attacker can perform a ws-legacy/loa…
Dec 25, 2023
An issue was discovered in RWS WorldServer before 11.7.3. /clientLogin deserializes Java objects without authentication…
Dec 25, 2023
An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all au…
Dec 25, 2023
Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized…
Aug 1, 2023
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2024-50849 | A Stored Cross-Site Scripting (XSS) vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote authenticated attacker to execute arbitra… | MEDIUM | 0.50% | Nov 18, 2024 |
| CVE-2024-50848 | An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive inform… | MEDIUM | 1.21% | Nov 18, 2024 |
| CVE-2022-34270 | An issue was discovered in RWS WorldServer before 11.7.3. Regular users can create users with the Administrator role via UserWSUserManager. | CRITICAL | 0.89% | Dec 25, 2023 |
| CVE-2022-34269 | An issue was discovered in RWS WorldServer before 11.7.3. An authenticated, remote attacker can perform a ws-legacy/load_dtd?system_id= blind SSRF attack to de… | HIGH | 1.71% | Dec 25, 2023 |
| CVE-2022-34268 | An issue was discovered in RWS WorldServer before 11.7.3. /clientLogin deserializes Java objects without authentication, leading to command execution on the ho… | CRITICAL | 1.46% | Dec 25, 2023 |
| CVE-2022-34267 | An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Jav… | CRITICAL | 42.16% | Dec 25, 2023 |
| CVE-2023-38357 | Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessions. | MEDIUM | 5.35% | Aug 1, 2023 |
Showing 1 to 7 of 7 CVEs