They said "The remote host is running a web server that fails to adequately sanitize request strings of malicious JavaScript. By leveraging this issue, an attacker may be able to cause arbitrary HTML and script code to be executed in a user's browser within the security context of the affected site."
"To verify this vulnerability, it is often required to do a raw HTTP(s) request. Using curl/wget or your browser you probably won't be able to reproduce the vulnerability due to automatic encoding of those tools. A raw request can be issued using either nc (netcat) or openssl."
