Cross-site scripting (XSS)
A person can insert script code into a site, mostly bulletin boards are used, since they support the input of html in posts. When you, the visitor, load the post and execute the script, anything can happen:
- You can be asked for, for example, creditcard info (though, it will be unlikely this will happen on a bulletin board). You enter the info and you're a goner
- The script retrieves, without you noticing, your userid and password and sends it to the creator of the script. This way your identity, on the specific site, has been stolen
- Anything can be done, since a script can be varied endlessly
There's nothing to do against XSS, except for keeping your browser up tod ate and configuring your browser to surf the web safely