SuperScan is a free McAfee tool used by customers to quickly scan their networks for system level information. It is possible to inject a Cross Site Script (XSS) payload into the SuperScan HTML report, based on the response from the host.

The precondition to successfully exploit this vulnerability is that the attacker must already have a compromised server executing on the scan target network. Therefore, this XSS attack does not give the attacker further privilege escalation or similar advantage. The attack is against the browser when reading a SuperScan report in an HTML browser.

This update resolves the vulnerability, whereby the attacker can no longer submit code within the data channel to the HTML report output.

CVE-2013-4884
Cross-site scripting (XSS) vulnerability in McAfee SuperScan 4.0 allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded sequences in a server response, which is not properly handled in the SuperScan HTML report.
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4884