CVE-2010-1164

Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA 3.12 through 4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) element or (2) defaultColor parameter to the Colour Picker page; the (3) formName parameter, (4) element parameter, or (5) full name field to the User Picker page; the (6) formName parameter, (7) element parameter, or (8) group name field to the Group Picker page; the (9) announcement_preview_banner_st parameter to unspecified components, related to the Announcement Banner Preview page; unspecified vectors involving the (10) groupnames.jsp, (11) indexbrowser.jsp, (12) classpath-debug.jsp, (13) viewdocument.jsp, or (14) cleancommentspam.jsp page; the (15) portletKey parameter to runportleterror.jsp; the (16) URI to issuelinksmall.jsp; the (17) afterURL parameter to screenshot-redirecter.jsp; or the (18) HTTP Referrer header to 500page.jsp, as exploited in the wild in April 2010.

• CWE-79

• http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2010-04-16Patch, Vendor Advisory
• http://jira.atlassian.com/browse/JRA-20994Vendor Advisory
• http://jira.atlassian.com/browse/JRA-21004Patch, Vendor Advisory
• http://secunia.com/advisories/39353Vendor Advisory
• http://www.openwall.com/lists/oss-security/2010/04/16/3
• http://www.openwall.com/lists/oss-security/2010/04/16/4
• http://www.securityfocus.com/bid/39485
• https://exchange.xforce.ibmcloud.com/vulnerabilities/57826
• https://exchange.xforce.ibmcloud.com/vulnerabilities/57827
• http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2010-04-16Patch, Vendor Advisory
• http://jira.atlassian.com/browse/JRA-20994Vendor Advisory
• http://jira.atlassian.com/browse/JRA-21004Patch, Vendor Advisory
• http://secunia.com/advisories/39353Vendor Advisory
• http://www.openwall.com/lists/oss-security/2010/04/16/3
• http://www.openwall.com/lists/oss-security/2010/04/16/4
• http://www.securityfocus.com/bid/39485
• https://exchange.xforce.ibmcloud.com/vulnerabilities/57826
• https://exchange.xforce.ibmcloud.com/vulnerabilities/57827

Published

Apr 20, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-1158Integer overflow in the regular expression engine in Perl 5.…
• CVE-2010-1159Multiple heap-based buffer overflows in Aircrack-ng before 1…
• CVE-2010-1160GNU nano before 2.2.4 does not verify whether a file has bee…
• CVE-2010-1161Race condition in GNU nano before 2.2.4, when run by root to…
• CVE-2010-1162The release_one_tty function in drivers/char/tty_io.c in the…
• CVE-2010-1163The command matching functionality in sudo 1.6.8 through 1.7…
• CVE-2010-1165Atlassian JIRA 3.12 through 4.1 allows remote authenticated …
• CVE-2010-1166The fbComposite function in fbpict.c in the Render extension…
• CVE-2010-1167fetchmail 4.6.3 through 6.3.16, when debug mode is enabled, …
• CVE-2010-1168The Safe (aka Safe.pm) module before 2.25 for Perl allows co…
• CVE-2010-1169PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before …
• CVE-2010-1170The PL/Tcl implementation in PostgreSQL 7.4 before 7.4.29, 8…