Cross-Site Scripting (XSS)

Unidata's THREDDS project is vulnerable to cross-site scripting. An attacker is able to inject arbitrary Javascript into a victim's browser via the URL or HTTP headers and steal session tokens or perform unwanted actions on behalf of the user...