Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager 6.0 through 6.0 SP4 7.0 and 7.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.