Cross-Site Scripting

All,

We recently got smashed by our security team because of various vulnerabilities within our environment…some believed to be server related, others application related. More specifically, our security team ran a tool called WebInspect against our website and came back with numerous issues with Cross-Site Scripting. Below is an example, but my question is: does anybody have any experience in this area that could help us out? How best can we guard our environment against such attacks?

example:

https://www.test.com:443/home.nsf/FAQs?OpenView&Start=3&Count=50&Collapse=3#3c%2FsCripT><sCrIpT>window.location%3D81635<%fsCrIpT>&Click=

Thanks in advance.

Cyg