Cross-site scripting (XSS) vulnerability in Computer Associates (CA) eTrust SiteMinder 5.5 when the \CSSChecking\ parameter is set to \NO \ allows remote attackers to inject arbitrary web script or HTML via the (1) PASSWORD or (2) BUFFER parameters to smpwservicescgi.exe (3) the TARGET parameter to login.fcc and possibly other vectors.