Several vulnerabilities have been discovered in Sun Java System Calendar Express web server. First, an attacker can crash the web server creating a Denial of Service condition by simply requesting certain URL twice. Second, several Cross-site scripting vulnerabilities were found in the following files/urls: 'https://<server>:3443/login.wcap' and 'https://<server>:3443/command.shtml'. Cross-site scripting (XSS) vulnerabilities allow an attacker to execute arbitrary scripting code in the context of the user browser (in the vulnerable application's domain). For example, an attacker could exploit an XSS vulnerability to steal user cookies (and then impersonate the legitimate user) or fake a page requesting information to the user (i.e. credentials). This vulnerability occurs when user-supplied data is displayed without encoding.