Re: [Full-disclosure] posting xss notifications in sites vs software packages

[Packet Storm <fulldis@xxxxxxxxxxxxxxxxxxxxxxx>]

On Tue, Feb 07, 2012 at 06:18:24PM -0500, b wrote:
> What is the point of posting notifications of XSS vulnerabilities in
> specific web sites instead of alerts of xss vulns in specific software
> packages?
> 
> This question was prompted by all the postings by that vulnerability lab
> stuff.

In some cases, a cross site scripting vulnerability in a given site can affect 
a large user base and the code is custom to the business.  As an example, a 
cross site scripting issue in gmail is probably more catastrophic than a cross 
site scripting vuln in some half-rate CMS.  Not to mention there's the other 
situation where small website design shops repackage other open source code, 
brand it as part of their offering, and never provide updates to their 
customers.  The Internet is a mess.  $0.02

-Todd

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/