Written by DPTuesday, 5 October 2010Three more critical vulnerabilties have been reported for AmericanExpress.com… The other XSS is still pending a fix. “PaPPy” has reported an open redirect vulnerability in search.americanexpress.com and one XSS bug on the card reviews forum. “d3v1l” from Security-Sh3ll has reported a cross-site scripting hole affecting the supposedly secure American Express online rewards mall, a shopping portal that offers special offers and discounts to PASS prepaid card members at hundreds of online merchants, as well as in stores. “Ensuring proper validation of all inputs in Web applications, in order to prevent cross-site scripting and SQL injection vulnerabilities, is actually a requirement of the Payment Card Industry Data Security Standard (PCI-DSS).”, Lucian Constantine, SoftPedia’s security columnist, writes. To avoid further embarrassment, American Express must really review their data security operating policy and update it correctly in order to achieve compliance with their following statements, since they are founding |
|---|
