Cross-site scripting (XSS) vulnerability in the Hitachi JP1/HiCommand Device Manager Tiered Storage Manager Replication Monitor and GlobalLink Availability Manager before 20070528 allows remote attackers to inject arbitrary web script or HTML via the Expect HTTP header.