Hi!

2 weeks ago i discovered this XSS:
s
in Internet Explorer(fully patched and with SP2)

I also discoverd they Liu Die Yu(greetings pal) discovered it a long time 
ago.

More details at:
http://www.securiteam.com/windowsntfocus/6J006156AS.html 

This means it was not patched, even in SP2.
This vulnerability does not effect outlook express.

Rafel Ivgi, The-Insider.