posting xss notifications in sites vs software packages

["b" <b () advisoryalerts com>]

What is the point of posting notifications of XSS vulnerabilities in
specific web sites instead of alerts of xss vulns in specific software
packages?

This question was prompted by all the postings by that vulnerability lab
stuff.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/