Multiple cross-site scripting (XSS) vulnerabilities in the WebApp JSP Snoop page in Mort Bay Jetty 6.1.x through 6.1.21 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) jspsnoop/ (2) jspsnoop/ERROR/ and (3) jspsnoop/IOException/ and possibly the PATH_INFO to (4) snoop.jsp.