Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Provisioning Manager Express allow remote attackers to inject arbitrary web script or HTML via the (1) \assess modification \ (2) user-id and other unspecified fields to the /tpmx URI; or (3) involving unspecified vectors related to \error processing.\