Security company says Nasdaq waited two weeks to fix XSS flaw