Dww

A cross-site scripting (XSS) issue allows remote authenticated users with create or edit group nodes permissions to inject arbitrary web script or HTML via the User-Agent HTTP header.

A cross-site scripting issue exists in the theme views bulk operations confirmation function within the views bulk operations.module, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors related to node titles.

The issue allows remote attackers to inject arbitrary web script or HTML via unspecified `parameters`. This is possible because the `check plain` function is not used.