Facebook's "Reset Password" page suffers major XSS flaw

Written by Dimitris Pagkalos

DaiMon has once more discovered a new critical cross-site scripting vulnerability which affects the Facebook "Reset Password" page.

Facebook users are susceptible to phishing attacks and ID theft due to some new highly critical cross-site scripting vulnerabilities.

In this case, the fact that SSL is being used on the login page, does not necessarily mean that the users' login information is secured.

Dan Goodin wrote a good article on TheRegister.co.uk about the titled issue. This is not really a new vulnerability.

Security researchers Octane[F/X], Rodrigo Lacerda and Klay Gomes were able to hack again Orkut with their new XSS worm.

DaiMon and mox have discovered two critical XSS flaws on Citibank's website.

31534 total xss 1615 fixed 6297 xss onhold 1009 EW subscribers