AppScan 4 Audit Edition has a flaw where the Explore stage of the utility has an automatic scan option. When a reference to a URL in an href tag is made using a wrapper function instead of directly calling window.open or document.location javascript functions, AppScan will not detect the link and the URL will not be tested against any attack.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/31693/appscan.txt
Source: https://packetstormsecurity.com/files/31693/appscan.txt.html