4 ms·

Oh wow, unprotected admin tools and an XSS vulnerability on their main homepage that is used for customer logins. That's pretty bad.

• JoshTriplett 15y ago
  The utter lack of a mechanism to report bugs, particularly security bugs, seems far worse. I've encountered this problem frequently when interacting with various organizations. The pervasive availability of bug-tracking systems and/or bug-reporting email addresses makes the absence of one quite conspicuous.
  • michiel3 15y ago
    I've many seen organizations applying spam filtering on their security@org.org address, leading to tons of reports ending up in spam boxes without being noticed by the company. The researcher doesn't receive any feedback on his responsible disclosure and multiple reminders, and finally submits the vulnerability to a full disclosure list.
    • JoshTriplett 15y ago
      Even worse: some businesses apply spam filtering to their abuse@ address, which thus rejects reports of spam as...spam.
  • deleted 15y ago
    [deleted]