|06 Oct 2010||#1|
XSS flaws found on three security firms' websites
A group of white-hat hackers has discovered various XSS vulnerabilities on websites belonging to three well-known security companies, and have reported it to the firms themselves so that they can fix them them as soon as possible.
"XSS vulnerability is a high level vulnerability which could allow an attacker to steal sensitive data such as login information and other credentials," said one of the members of white-hat Team Elite to The Register. "I've noticed that all three security vendors have fixed the bugs on their websites, which is very positive."
The three security firms in question are Symantec, Eset and Panda Security, and as the group points out, these XSS flaws could easily allow attackers to push their own malicious content to visitors or for executing phishing attacks. XSS flaws basically happen because of errors in coding, but one would think that security firms would be especially careful to avoid things like that on their pages.
Fortunately, it seems these particular flaws have not been misused before the patching, but this instance should be a lesson for us all. And that lesson is - always keep your eyes on the ball.
|My System Specs|
|06 Oct 2010||#3|
This must be a second set of XSS bugs found on ESET and Symantec websites.
Bugs on Kaspersky, BitDefender, Avast, McAfee, AVG, F-Secure, and Avira websites have also been found.
And that's only of the anti-virus vendor websites, I know of. There have also been bugs on other big name websites found, such as on Ebay, Intel and certain American banking websites, to name a few.
Most of them found by members of Team Elite, I believe.
|My System Specs|
|Similar help and support threads for2: XSS flaws found on three security firms' websites|
|Only 36% of small firms apply security patches||Security News|
|Oracle investigating after two more Java 7 zero-day flaws found||Security News|
|Patch Tuesday: Microsoft to fix five critical security flaws||Security News|
|Oracle to Patch Dozens of Security Flaws Tomorrow||Security News|
|Security.Why Counting Flaws is Flawed||Security News|
|More flash drive firms warn of security flaw.||Security News|
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.
© Designer Media Ltd
All times are GMT -5. The time now is 06:00.