Security Update for TSWA 2008 SP1
From Hakan Eskici's blog:
A security issue has been identified with Team System Web Access 2008 SP1 and we have recently published an update that fixes it.
Installation Notice
Please note that this is a full release, so you will need to uninstall any existing versions of Web Access before installing this update.
Update: Instructions to patching your installation without the need to uninstall/reinstall TSWA)
Update #2: KB article 961267 is now available.
Determining if the update is installed
Take a look at the About page (Help > About) in Web Access.
The version number will be 9.0.3275 for TSWA 2008 SP1 Update.
Download: Visual Studio Team System Web Access 2008 SP1 Power Tool