Microsoft Outlook Web Access is vulnerable to an HTML code injection/cross site scripting attack. A malicous user could craft a mail containing HTML and Javascript code. Such code could be used to steal session information from the victims cookies, and thus enable the attacker to get access to the victim’s emails.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/47883/SA-20060613-0.txt
Source: https://packetstormsecurity.com/files/47883/SA-20060613-0.txt.html