Google Search Appliance UTF-7 Cross-Site Scripting Security Vulnerability

Description
Input passed to the "q" or/and "search_string" parameters (when "oe=UTF-7" and the parameter value is UTF7 encoded) is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an affected site when malicious data is viewed.

Impact
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

References
Original Advisory
Product Homepage