The travel.cnn.com and ads.cnn.com sites suffer from cross site scripting and open redirection vulnerabilities.