10x XSS on apple.com
A page that lets you run arbitrary JavaScript in your own browser is not automatically vulnerable .  For it to be a vulnerability you must be able to run arbitrary JavaScript in someone else's browser.  If these pages protect against CSRF, most of them aren't vulnerable, expresslane being one case where I think you could get the JS to someone else without CSRF.