Josh Perrymon zei: > Ok, > [ directory transversal vulnerability in a search program ] > > So I ask the list- what is more beneficial to the customer? Not publicly > disclosing the risk and hoping that they follow the suggestions of the > vendor to upgrade? Or waiting 30 days and send it out?
First look at the contract for the pentest. Are you allowed to disclose this? Often your contract prevents this. Be careful! M4 (but then magically someone else who is not under contract or NDA finds this bug a few weeks later....) _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
