Input passed to the "User-Agent" header parameter it isn't properly sanitised before being returned to the user on 404 or 500 error. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Confirmed in version MX 7. Other versions may also be affected.
Contact the vendor for further information.