Javascript
Javascript can do almost anything the end-user can do -- the human is out of the loop.
No simple protection model.
Many bugs have been found, in both Netscape and Microsoft browsers.
Java + Javascript is a particularly dangerous combination.