A security researcher who found a major vulnerability in eBay’s website last week said a second flaw he found hasn’t been fixed and could be used to hijack user accounts. Jordan Lee Jones, a 19-year-old college student who lives in Stockton-on-Tees, U.K, said he notified eBay on Friday by email of the second vulnerability. It hadn’t been fixed as of Monday, so he decided to publish details of it on his blog. “Ebay should be on top of their stuff,” he said in an instant message conversation late Monday. EBay officials couldn’t be reached in the U.S. due to the long holiday weekend. Jones and several other security researchers have been taking a close look at eBay’s network since the company disclosed a data breach last Thursday. The company said attackers gained log-in credentials for a small number of employees in late February and early March.