DOM Cross Site Scripting

Variants:
Direct 

Also Known As:
DXSS

Vector Operation Method:
Javascript and VBScript code which insecurely embeds user-controlled content in the DOM or in dynamically generated content can be abused by attackers to present attacker-controlled scripts to legitimate application users, thus, allowing the attackers to bypass the browser same origin policy, in order to steal users credentials, cookies and sensitive information, as well as perform operations on behalf of the attacked users without their consent or knowledge.