Description
Microsoft Outlook 2002 allows remote attackers to execute arbitrary JavaScript code, even when scripting is disabled, via an "about:" or "javascript:" URI in the href attribute of an "a" tag.
References
- outlook-href-url-javascript(8613) vdb-entry
- 20020320 Questionable security policies in Outlook 2002 mailing-list
- 4337 vdb-entry