In theory they can have any arbitrary script. In practice, only a handful of scripts are considered standard and will be relayed on the network: pay to pubkey, pay to pubkey hash, null data (op_return), pay to script hash and raw multisig.