HSBC, Barclays and The Telegraph sites were found vulnerable to cyber fraud

Last week was a week of numerous discoveries of high-profile web vulnerabilities, with discoveries of careless bugs on the sites of three British companies, says the Register. Hackers published the screenshots and other details of online banking sites for HSBC and Barclays Group and the website for The Telegraph that showed all three were susceptible to attacks that could compromise the security of people who visit the properties.

The paper says that the XXS, or cross-site scripting, errors on HSBC were still present on a variety of HSBC sites on Monday afternoon California time, some 48 hours after the XSSed blog first reported them. These flaws allowed hackers to inject javascript and content into HSBC websites simply by tricking a user into clicking on a specially manipulated web address.

According to the researchers Barclays had similar bugs but as of Monday afternoon, they appeared to have been fixed.

Another XSSed report of the HackersBlog revealed details of a SQL injection vulnerability in the main website for The Telegraph. As the Reg reports the vulnerability looked especially severe because it exposed sensitive system files to those who knew how to append database commands to the website address.