Multiple cross-site scripting (XSS) vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) ctrl (2) t90001_0_theform_selection (3) _scroll (4) tableName (5) parent (6) circuit (7) return (8) xname or (9) mpTransactionId parameter.