Newly released client data from White Hat Security finds organizations are slow to close known security holes in their Websites  By Kelly Jackson Higgins | DarkReading

Most Websites harbor at least one major vulnerability, and over 80 percent of Websites have had a critical security flaw, according to new data released today by WhiteHat Security.

The Website vulnerability statistics, based on Website vulnerability data gathered from WhiteHat's own enterprise clients, show that 63 percent of Websites have at least one high, critical, or urgent vulnerability issue, and there's an average of seven unfixed vulnerabilities in a Website today.

"What we know from this report is that the Web is at least this insecure," says Jeremiah Grossman, CTO of WhiteHat.

Editor's Note:  I know I've been saying this for about a year now on this blog, but the web is NOT secure.  So why are we "Typing" our PAN's and soon to be "clicking" our PINs into boxes located on merchants websites?  If 63% of websites have a "critical" security flaw/vulnerability, then financial transactions should be done "outside" the browser space right?  Take into account that 70% of websites were the victim of a hack attempt, and that leaves us with a 30% chance our "supposedly valuable financial information" WON"T get stolen.  Financial Transactions, "especially" PIN transactions MUST be End-to-End Encrypted and the only way to do that is via a hardware device which "transacts" OUTSIDE the browser space. 

Does that make sense to anyone else besides myself?  Chime in!   The article continues:

The top ten classes of vulnerabilities hasn't changed much from WhiteHat's findings in the fourth quarter of 2008. The pervasive cross-site scripting (XSS) flaw still leads the pack as the most likely vulnerability in a Website, with a 65 percent chance that a Website has XSS bugs, followed by information leakage, with 47 percent.

And the average number of vulnerabilities per Website over its lifetime is 17, according to WhiteHat's data.

"Customers are fixing large swaths of vulnerabilities, but it's really tough to wipe out 100 percent of vulnerabilities, even by class and severity," Grossman says. "And even if you fix nine of 10 cross-site scripting vulnerabilities, you still have one. That's why the percentage of sites likely to have cross-site scripting vulns is" so high, he says.

And all it takes is one XSS vulnerability for an attacker to do his dirty work, he says.

Around 30 percent of Websites are likely to contain content spoofing bugs; 18 percent, insufficient authorization; 17 percent, SQL injection; 14 percent, predictable resource location; 11 percent, session fixation; 11 percent, cross-site request forgery (CSRF); 10 percent, insufficient authentication; and 9 percent, HTTP response-splitting flaws, according to WhiteHat's latest counts.

Continue "Dark Reading"