Zero-Day Exploits Abound at Legitimate Web Sites