Multple McAfee domains are vulnerable to XSS attacks that can be used in various ways, not to mention phishing or doing drive by malware installs.  Plainly stated, if you are vulnerable to XSS attacks, then you are NOT PCI compliant. 

McAfee is a trusted name in computing and the presence of XSS vulnerabilities in their corporate Web applications is a case-in-point of the highly vulnerable nature of production applications.

Check out this HackerSafe video that illustrates:

1. Sites that are vulnerable to XSS are not PCI compliant. All of the sites in this video take credit card payments and store customer information.
2. The sites in this video have been vulnerable for months. Additionally, some have been advised multiple times and have simply ignored my notices. Their Hacker Safe branding is active and has not been removed at any time.
3. The ScanAlert Hacker Safe service claims XSS as part of its vulnerability checks; sites that are vulnerable to it should not be showing the Hacker Safe label in perpetuity.

Here’s another scathing article by ZDNet entitled, "McAfee's HackerSafe:  When all esle fails, rebrand it." 

by
Tom Stracener
TStracener@cenzic.com