Malicious setRequestHeader cross-site vulnerability

A malicious setRequestHeader can be used to stealuser credentials and inject cross-site JavaScript...