Security Company Says NASDAQ Waited Two Weeks To Fix XSS Flaw

Posted by samzenpus on Monday September 16, 2013 @06:53AM from the better-late-than-never dept.

alphadogg writes "A Swiss security company said the NASDAQ website had a serious cross-site scripting vulnerability for two weeks before being fixed on Monday, despite earlier warnings. Ilia Kolochenko, CEO of the Geneva-based penetration testing company High-Tech Bridge, said he repeatedly emailed NASDAQ and warned of the XSS flaw. 'I can basically say I have spammed them,' Kolochenko said in an interview. A NASDAQ spokesman did not have immediate comment. NASDAQ.com lets users create accounts and build a profile to monitor stocks and news."

2 of 61 comments (clear)

Min score:

Reason:

Sort:

Very difficult. by d33tah · 2013-09-16 06:55 · Score: 4, Funny

What are you laughing at, it's clearly very difficult to fix one XSS vulnerability.
Re:good process is not trivial by NatasRevol · 2013-09-16 08:13 · Score: 4, Funny

In reality,
Dev gets email, updates code, posts to live website.
He's just 3 weeks behind on email.

--
There are two types of people in the world: Those who crave closure