Security watchdog XSSed found 30 cross-site vulnerabilities on McAfee, Symantec and VeriSign sites. Computerworld reports that the bugs could be used to launch scams or inject malicious code.

The Tech Herald notes that McAfee has fixed seven of the eight vulnerabilities on its site; VeriSign has addressed all five issues on its site; and Symantec has corrected 10 of the 17 flaws on its site.

McAfee has downplayed the seriousness of the report, but launching malware from legitimate sites is nothing new. Earlier this month, ScanSafe reported that 68 percent of all Web-based malware it blocked came from legitimate sites. That's a 407 percent increase from May 2007.

As IT BusinessEdge Blogger Carl Weinschenk pointed out in an April blog, the move to putting malware on legitimate sites came from the bad guys flailing away trying to figure out what will work. Hackers are banking on visitors not having adequate protection. A multi-layered, defense-in-depth approach to security is necessary, because you never know if that familiar Facebook site you're visiting is infected.