The user supplied deviceToken needs XSS protection. By issuing a malicious request an attacker can make visiting the /installations/ page result in a complete application compromise (as these pages have permission to issue all available REST calls). This is by simply having the entry pulled up, the victim doesn't have to "expand" it or otherwise interact with the installation entry to trigger the payload.
Upstream Issue: https://issues.jboss.org/browse/AEROGEAR-1513
Statement: Not Vulnerable. Aerogear is not provided by any Red Hat product.
As reported by Jan Rusnacko, this same flaw effect almost all of the account management fields: Email, Last Name, First, Name. That vector is not quite as serious (as it requires auth) but has been noted in this additional upstream issue: https://issues.jboss.org/browse/AGPUSH-1082
Acknowledgements: This issue was discovered by Jan Rusnacko and Trevor Jay of Red Hat Product Security.
IssueDescription: Multiple persistent cross-site scripting (XSS) flaws were found in the way Aerogear handled certain user-supplied content. A remote attacker could use these flaws to compromise the application with specially crafted input.