The link mentioned responsible disclosure and it's wikipedia page ( http://en.wikipedia.org/wiki/Responsible_disclosure ) mention two of the primary players who buy vulnerabilities as you mention.