XSS flaws found on three security firms’ websites

A group of white-hat hackers has discovered various XSS vulnerabilities on websites belonging to three well-known security companies, and have reported it to the firms themselves so that they can fix them them as soon as possible.

“XSS vulnerability is a high level vulnerability which could allow an attacker to steal sensitive data such as login information and other credentials,” said one of the members of white-hat Team Elite to The Register. “I’ve noticed that all three security vendors have fixed the bugs on their websites, which is very positive.”

The three security firms in question are Symantec, Eset and Panda Security, and as the group points out, these XSS flaws could easily allow attackers to push their own malicious content to visitors or for executing phishing attacks. XSS flaws basically happen because of errors in coding, but one would think that security firms would be especially careful to avoid things like that on their pages.

Fortunately, it seems these particular flaws have not been misused before the patching, but this instance should be a lesson for us all. And that lesson is – always keep your eyes on the ball.