WebEx Downloader plug-in contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the ActiveX control installed by WebEx not properly sanitizing user input supplied to the the "GpcUrlRoot" and "GpcIniFileName" variables. This may allow an attacker to include a DLL file from a remote host that contains arbitrary commands which will be executed by the vulnerable object under the security context of the user viewing the web
Upgrade to version SP30 (see Vendor Specific Solution URL) or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.