Multiple cross-site scripting (XSS) vulnerabilities in DiamondList 0.1.6 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the (1) categorydescription parameter to user/main/update_category which is not properly handled by _app/views/categories/index.html.erb; and the (2) settingsite_title parameter to user/main/update_settings which is not properly handled by _app/views/settings/_list_settings.rhtml.