An attacker can run arbitrary commands on Windows machines with a simple bit of HTML, an Israeli security researcher has demonstrated. The exploit will work with IE, Outlook and Outlook Express even if active scripting and ActiveX are disabled in the brow
Link Details for: The Register: IE, Outlook Run Malicious Commands Without Scripting
