This PDF published by CERT gives a brief overview of cross-site scripting vulnerabilities and suggests solutions to the problem. "A CSS vulnerability is caused by the failure of a site to validate user input before returning it to the clients web-browser. > The essence of cross-site scripting is that an intruder causes a legitimate web server to send a page to a victim's browser that contains malicious script or HTML of the intruder's choosing. The malicious script runs with the privileges of a legitimate script originating from the legitimate web server.
News: Security Sources
