Exploiting vulnerabilities in Johnson & Johnson web apps

Reading posts about security flaws it feels like there really isn't any middle ground between "I found a flaw in the ECDSA key derivation algorithm when in fallback compatibility mode; here are seven pages of equations describing the vulnerability" and "I told the computer I was an admin and the computer believed me".