Cross-site scripting vulnerability in Cobalt RAQ 4 allows remote attackers to execute arbitrary script as other Cobalt users via Javascript in a URL to (1) service.cgi or (2) alert.cgi.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2002-0343
http://www.securityfocus.com/bid/4211