Need help. Urgently

[kamejoko]

I need a serious legit advice. I recently found a vulnerability in a series of websites. I don't know what is legal and what I should do among the followings:

1. Publish this bug without warning the webmaster of those websites (and refer those sites as examples of the bug). (easiest)

2. Email webmasters to let them know and publish that bug.

3. Email webmasters, ask for their permission and then publish
that bug, refer their sites only if get permission. (I don't like at all, because it is unlikely that I will get the permission).

Please help me.

 

[sp0radic]

3, 3 would be the best. Probably.

 

[LastActionHero]

email the webmaster, then email the writer of that script , then contact a security site like security focus and get credit for exposing the security hole by being the first to report it (make sure you have a possible solution also)

 

[Hoth]

3 is likely the safest. If you're in the U.S., they seem to be able to prosecute people under the DMCA for just about anything.

1 is ok if you're sure none of the sites are owned by rich companies which have lawyers with nothing better to do than try to go after you.