The thing that prompted me on this was this: http://www.vmware.com/support/kb/enduser/std_adp.php?p_faqid=2001 which FRSIRT:ADV-2005-3084 seems to think is XSS although it's not clear why. - Steve