what about this:
http://www.atstake.com/research/advi.../a040301-1.txt

and for further info a very good list of apps and their vulnerabilities
http://www.internetbankingaudits.com...rabilities.htm

---------------------------------------------------------------------------------------------------------------
"Knowledge is the Real Power"