Zero Day Initiative Advisory 10-135 – This vulnerability allows remote attackers to execute arbitrary client side script on vulnerable installations of Novell Groupwise WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within handling html messages sent to a Novell Groupwise WebAccess user. Messages are improperly sanitized allowing client side script to be supplied to the user’s web browser resulting in the user’s WebAccess credentials being compromised.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/92018/ZDI-10-135.txt
Source: https://packetstormsecurity.com/files/92018/Zero-Day-Initiative-Advisory-10-135.html