IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.11 on z/OS allows attackers to perform unspecified "link injection" actions via unknown vectors.
http://www.vupen.com/english/advisories/2010/1411
http://www-01.ibm.com/support/docview.wss?uid=swg1PM15829