If we are going to release security flaws which might lead us into an industry shakedown, we may as well go for the trifecta.
Yes, these have been disclosed/reported to the hosts with adequate time allowed for acknowledgment. The NASDAQ one is quite intriguing since you can rewrite the site's html source.
When will programmers learn to write secure from day one?
… why post 2 xss flaws? there are millions out there :>
@mybeNi: For purposes of full disclosure so people are aware of the issue. Hopefully, through awareness people will not be fooled if the sites are used for fraudulent purposes.