CVE-2017-16863

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The PieChart gadget in Atlassian Jira before version 7.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a project or filter.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Atlassian	Atlassian Jira	All versions prior to version 7.5.3

References

http://www.securityfocus.com/bid/102732Third Party Advisory, VDB Entry
https://jira.atlassian.com/browse/JRASERVER-66623Issue Tracking, Vendor Advisory
http://www.securityfocus.com/bid/102732Third Party Advisory, VDB Entry
https://jira.atlassian.com/browse/JRASERVER-66623Issue Tracking, Vendor Advisory

Timeline

Published: Jan 18, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-168646.1The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross CVE-2017-168655.3The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a CVE-2017-168666.1dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting (XSS) in core/M_Controller.php via the DR_URI field.CVE-2017-168676.5Amazon Key through 2017-11-16 mishandles Cloud Cam 802.11 deauthentication frames during the delivery process, which makes it easier for (1)CVE-2017-168685.5In SWFTools 0.9.2, the wav_convert2mono function in lib/wav.c does not properly restrict a multiplication within a malloc call, which allows CVE-2017-168697.8p_mach.cpp in UPX 3.94 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have u CVE-2017-168708.1The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.CVE-2017-168718.1The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/pl CVE-2017-168729.8An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. Parsing the numeric header fields in a SIP message CVE-2017-168737.8It is possible to exploit an unsanitized PATH in the suid binary that ships with vagrant-vmware-fusion 4.0.25 through 5.0.4 in order to esca CVE-2017-168757.5An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. The ioqueue component may issue a double key unregi CVE-2017-168766.1Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arb