Webglimpse Brute Force / Cross Site Scripting

`Hello list!  
  
I want to warn you about new security vulnerabilities in Webglimpse (in  
addition to previous ones). These are Brute Force and Cross-Site Scripting  
vulnerabilities.  
  
During 2008-2009 I've disclosed multiple vulnerabilities in Webglimpse  
(http://securityvulns.com/source15611.html), such as Cross-Site Scripting,  
Full path disclosure, Directory Traversal and Authorization bypass  
vulnerabilities.  
  
SecurityVulns ID: 9436  
SecurityVulns ID: 9443  
SecurityVulns ID: 9778  
SecurityVulns ID: 9876  
  
The first hole from them I've found already in 2007, when found  
vulnerability at site of Britain's Secret Intelligence Service (MI6, SIS),  
which was using this engine. Webglimpse - it's local search engine.  
  
-------------------------  
Affected products:  
-------------------------  
  
Vulnerable are Webglimpse 2.18.8 and previous versions. It was tested in  
Webglimpse 2.18.7 and 2.18.8, but the last version 2.20.0 (released this  
month) also should be vulnerable.  
  
Developers of Webglimpse were informed as this time, as four previous times,  
but they ignored all of the warnings and haven't fixed all these holes (at  
least officially).  
  
----------  
Details:  
----------  
  
Brute Force (WASC-11):  
  
http://site/wgarcmin.cgi  
  
Lack of protection against Brute Force attacks can be used to gain access to  
admin panel. At that it's possible to pick up login and password to guest  
account (if they aren't publicly available), which can be easier then to  
admin account, and then to use earlier mentioned Directory Traversal and  
Authorization bypass vulnerabilities to gain access to admin account.  
  
XSS (WASC-08):  
  
http://site/wgarcmin.cgi?URL2FIL=URL+2+File+--%3E&URL=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&NEXTPAGE=T  
  
http://site/wgarcmin.cgi?FIL2URL=%3C--+File+2+URL&FILE=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&NEXTPAGE=T  
  
http://site/wgarcmin.cgi?DOMAIN=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&NEXTPAGE=T  
  
I mentioned about these vulnerabilities at my site  
(http://websecurity.com.ua/3089/).  
  
Best wishes & regards,  
MustLive  
Administrator of Websecurity web site  
http://websecurity.com.ua  
  
`