Name of the parent IT service is not properly escaped. Consider the following use case:
1. Create a service with a name like "A&B".
2. Add a child service and observe that name of the parent service is truncated and is just "A".

This is related to the fact that name of the parent service is passed within an URL and it's value is not URL encoded.