appscan扫描出来的漏洞该如何解决，求大神降临指导
环境：XP+tomcat6.0.35

客户端攻击类型：内容电子欺骗

客户端攻击类型：跨站点脚本编制

http://localhost/

http://localhost/MonitorPoint/ 

http://localhost/MonitorPoint/_global/ --URL

http://localhost/MonitorPoint/js/

http://localhost/MonitorPoint/login/

http://localhost/MonitorPoint/login/login.faces

http://localhost/MonitorPoint/_global/resource/ext/ext-base.js

http://localhost/MonitorPoint/_global/resource/ext/ext-core.js  js脚本漏洞

禁用 WebDAV，或者禁止不需要的 HTTP 方法 关于这个问题在tomcat文件中添加如下代码是否可以解决

<init-param> 

    <param-name>readonly</param-name> 

        <param-value>true</param-value> 

</init-param>

求指导。
------解决方案--------------------