Multiple cross-site scripting (XSS) vulnerabilities in the Email application in HP Palm webOS 1.4.5 and 1.4.5.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
https://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02822174