Cross-site scripting (XSS) vulnerability in the Enterprise Admin Session Monitoring component in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the User-Agent HTTP header.

More... (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0178)