full-disclosure - Re: posting xss notifications in sites vs software packages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 8 Feb 2012 15:37:15 +0000
From: Packet Storm <fulldis@...ketstormsecurity.org>
To: b <b@...isoryalerts.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: posting xss notifications in sites
	vs	software packages

On Tue, Feb 07, 2012 at 06:18:24PM -0500, b wrote:
> What is the point of posting notifications of XSS vulnerabilities in
> specific web sites instead of alerts of xss vulns in specific software
> packages?
> 
> This question was prompted by all the postings by that vulnerability lab
> stuff.

In some cases, a cross site scripting vulnerability in a given site can affect a large user base and the code is custom to the business.  As an example, a cross site scripting issue in gmail is probably more catastrophic than a cross site scripting vuln in some half-rate CMS.  Not to mention there's the other situation where small website design shops repackage other open source code, brand it as part of their offering, and never provide updates to their customers.  The Internet is a mess.  $0.02

-Todd

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/