Advisory updates: Q1 2009 and a few more ...

Advisory updates, First Quarter, 2009, and a few from 2008.



DMOZ search's xss was found 2 months back... and NASA's XSS at Goddard space flight center, was exactly a month ago...

The other findings, from Myspace, AVG antivirus, and ESET antivirus websites, are also not fixed ... considering that these websites have a good user base, and are expected to fix quickly.

HSBC haven't fixed their bug just yet ... but it is obvious, they're a bank and they want money... not security ;)

The Indian government website, has removed the page having input sanitization problems, instead of fixing it... still not bad ... they've taken some measures to stay at bay ...

Cheers :)
Kish

And it is such a mystery ;)

And it is such a mystery why HSBC bank gets whacked, and phished a lot...


They've not fixed the bug (XSS) just yet, which was posted 3 months earlier...

HSBC Bank - XSS

###################################
# Website: http://www.hsbc.com
# (The world's phishing bank)
# Bug: XSS
# Date: 11.09.08
##################################

Vulnerable URL: hxxp://www.hsbc.com/1/2/exit-hsbc?type=1&url=

Click here for the XSS Demo

Bank websites are ones that are most targetted, reckless filtering *shrugs*

Cheers :)
Kish