On the XMLHTTP vulnerability: So far, we have only one confirmed sighting of this exploit, and it’s on an obscure website. If you ask me, this is a pretty crappy exploit (in that it doesn’t work all that well). We downloaded the page and according to Virustotal, only McAfee detected it.
Meanwhile, we are seeing the daxtcle.ocx exploit on a couple of sites, but it also is not widespread.
Just be careful out there.
Alex Eckelberry
(Thanks to Roger Thompson)