JavaScript, VBScript, ActiveX, and Flash are all client-side scripting technologies that can execute code in browsers, making them vectors for XSS attacks. SQL Server Management Studio is a database administration tool, not a browser scripting platform. Web services themselves don't execute XSS - the client that consumes them does.