The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the administration pages. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific user details or descriptions, including the first name, last name, repository description, repository group description, or user group description.