Facebook's "Reset Password" page suffers major XSS flaw

Written by DP

DaiMon has once more discovered a new critical cross-site scripting vulnerability which affects the Facebook "Reset Password" page.

Facebook users are susceptible to phishing attacks and ID theft due to some new highly critical cross-site scripting vulnerabilities.

In this case, the fact that SSL is being used on the login page, does not necessarily mean that the users' login information is secured.

Dan Goodin wrote a good article on TheRegister.co.uk about the titled issue. This is not really a new vulnerability.

Security researchers Octane[F/X], Rodrigo Lacerda and Klay Gomes were able to hack again Orkut with their new XSS worm.

DaiMon and mox have discovered two critical XSS flaws on Citibank's website.

35984 total xss 11629 special xss 1889 fixed 7829 xss onhold 1516 EW subscribers