Multiple cross-site scripting (XSS) vulnerabilities in IBM TRIRIGA Application Platform 2.x and 3.x before 3.3.1.1 and 8 allow remote authenticated users to inject arbitrary web script or HTML via (1) unspecified input to WebProcess.srv (2) unspecified input to html/en/default/actionHandler/queryHandler.jsp or (3) unspecified input in a portalSectionId action to html/en/default/reportTemplate/hGridTopQuery.jsp.