HyperAccess 8.4 allows user-assisted remote attackers to execute arbitrary vbscript and commands via a session (HAW) file, which can be automatically opened using Internet Explorer.
http://www.vupen.com/english/advisories/2006/5013
http://www.securityfocus.com/bid/21594
http://www.securityfocus.com/archive/1/454388/100/0/threaded