Netscape.com hacked

FYI…

- http://www.f-secure.com/weblog/archives/ar…6.html#00000927
July 26, 2006
"…Netscape.com has been hacked via a persistent Cross Site Scripting (XSS) vulnerability in their newly launched Digg-like news service. Attackers (who are obviously fans of Digg) have used the XSS vulnerability to inject their own javascript code snippets into pages on the website, including the homepage. As of now, it has only been used to display javascript alerts with "comical" messages and to redirect visitors to Digg.com!
Check out additional screenshots here* and here**.
Fortunately no one has tried to inject malcious code… yet…"

* http://www.f-secure.com/weblog/archives/Netscape1.jpg

** http://www.f-secure.com/weblog/archives/Netscape2.jpg

FYI…

- http://www.betanews.com/article/AOL_Fixes_…Hack/1153940441
July 26, 2006
"…The problem stemmed from inadequate filtering of stories, which did not strip out JavaScript code that exploited an XSS issue. "The site was never compromised,"* an AOL spokesperson told BetaNews. "The issue lasted a couple hours before it was fixed." The company says it does not believe any malicious code was submitted during that timeframe."

* ???