In the searchbox in the upper right of Achievo, users can enter arbitrary
javascript code, like this:

<script>alert(document.cookie)</script>

When no searchresults are found, this is executed 'as is', and a popup
displaying the cookie appears. 

While the potential risk of this is low, it is still something that should be fixed.