ICQ 2001a Alpha and earlier allows remote attackers to automatically add arbitrary UINs to an ICQ user's contact list via a URL to a web page with a Content-Type of application/x-icq, which is processed by Internet Explorer.
| Software | From | Fixed in |
|---|---|---|
| mirabilis / icq | 2000.0a | 2000.0a.x |
| mirabilis / icq | 2000.0b_build3278 | 2000.0b_build3278.x |
| mirabilis / icq | 2001a | 2001a.x |