In CyberArk Endpoint Privilege Manager (formerly Viewfinity) 10.2.1.603 there is persistent XSS via an account name on the create token screen the VfManager.asmx SelectAccounts->DisplayName screen a user's groups in ConfigurationPage the Dialog Title field and App Group Name in the Application Group Wizard.