With FastTips Newsletters your clients rave about how smart you are for giving them so much free information. Oh, and by the way, it won't cost you a fortune. A new security threat that puts all web users at significant risk has been describe in a security alert posted by the CERT Coordination Center, hosted by Carnegie-Mellon Software Engineering Institute and the Internet's most recognized security authority. CERT described in it's alert how a website may inadvertently include malicious HTML tags or a script in a dynamically generated webpage that can be based on unvalidated input from untrustworthy sources. This can be a problem when an Internet web server does not adequately ensure that generated pages are properly encoded to prevent unintended execution of scripts, and when input is not validated to prevent malicious HTML from being presented to the user.
Most web browsers have the capability to interpret scripts embedded in webpages.
Such scripts may be written in a variety of scripting languages and are run by the client's browser. Most browsers are installed with the capability to run scripts enabled by default. When a victim with scripts enabled in their browser reads this message, the malicious code may be executed unexpectedly. Other HTML tags can also be abused to alter the appearance of the page, insert unwanted or offensive images or sounds, or otherwise interfere with the intended appearance and behavior of the page. This vulnerability is unusual because it's not limited to software from any one particular vendor.