<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1555" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>Hi once more,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Two more corrections, and I think the rest is okay.
Sorry for the mistakes but this was a long list. Took several hours to figure it
all out. I was checking it but got distracted and sent it I guess before checked
thoroughly enough.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>These 2 have the versions changed:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>No log viewer before 0.9.9.3:</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>CVE-2007-1175 - Cross-site scripting (XSS)
vulnerability in an admin<BR>feature - The log viewer when HTML is entered as a
spoofed user agent.<BR>Discovered by Blackcode.<BR><A
href="http://newbc.blackcode.com/forum/index.php?t=msg&rid=0&th=1167&goto=10145#msg_10145">http://newbc.blackcode.com/forum/index.php?t=msg&rid=0&th=1167&goto=10145#msg_10145</A>
.<BR>Vulnerable: web-app.org WebAPP 0.9.9.3, 0.9.9.3.1, 0.9.9.3.2,
0.9.9.3.5,<BR>0.9.9.4; web-app.net WebAPP NE v0.9.9.3.3, 0.9.9.3.4; web-app.net
WebAPP NE<BR>2007 through at least 20070624.</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>No Gallery before 0.9.9.3:</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>CVE-2007-1176 - Multiple cross-site scripting (XSS)
vulnerabilities in in<BR>Gallery feedback, Gallery comments, Search results,
Statistics log viewer -<BR>Gallery XSS was persistent. Search results is client
side and found by<BR>Blackcode, posted at<BR><A
href="http://newbc.blackcode.com/forum/index.php?t=msg&rid=0&th=1167&goto=10033#msg_10094">http://newbc.blackcode.com/forum/index.php?t=msg&rid=0&th=1167&goto=10033#msg_10094</A>
.<BR>Statistics log viewer was same as entry CVE-2007-1175 . Vulnerable:
Gallery: web-app.org WebAPP v0.9.9.3, 0.9.9.3.1, 0.9.9.3.2, 0.9.9.3.5,
0.9.9.4;<BR>web-app.net WebAPP NE v0.9.9.3.3, 0.9.9.3.4; web-app.net WebAPP NE
2007<BR>through at least 20070624. Search Results: web-app.org WebAPP v0.8, 0.9,
0.9.3, 0.9.4, 0.9.5, 0.9.7, 0.9.8, 0.9.9,<BR>0.9.9.1, 0.9.9.2, 0.9.9.3,
0.9.9.3.1, 0.9.9.3.2, 0.9.9.3.5, 0.9.9.4;<BR>web-app.net WebAPP NE v0.9.9.3.3,
0.9.9.3.4; web-app.net WebAPP NE 2007<BR>through at least 20070624. Statistics
Log Viewer: See CVE-2007-1175.<BR></FONT></DIV></BODY></HTML>