Multiple cross-site scripting (XSS) vulnerabilities in the web interface in Aruba Mobility Controller 2.4.8.x-FIPS 2.5.5.x 2.5.6.x 3.1.1.x 3.2.0.x and 3.3.1.x allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.