CVE-2016-6285

Cross-site scripting (XSS) vulnerability in includes/decorators/global-translations.jsp in Atlassian JIRA before 7.2.2 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header.

• CWE-79

• http://packetstormsecurity.com/files/140548/Atlassian-Jira-7.1.7-Cross-Site-Scripting.htmlExploit, Third Party Advisory
• http://seclists.org/fulldisclosure/2017/Jan/41Exploit, Third Party Advisory
• http://www.securityfocus.com/bid/95913Third Party Advisory, VDB Entry
• https://confluence.atlassian.com/adminjira/jira-platform-releases/jira-7-2-x-platform-release-notes#JIRA7.2.xplatformreleasenotes-7-2-2Release Notes
• https://jira.atlassian.com/browse/JRA-61888?src=confmacro&_ga=1.139403892.63283854.1485351777Exploit, Vendor Advisory
• http://packetstormsecurity.com/files/140548/Atlassian-Jira-7.1.7-Cross-Site-Scripting.htmlExploit, Third Party Advisory
• http://seclists.org/fulldisclosure/2017/Jan/41Exploit, Third Party Advisory
• http://www.securityfocus.com/bid/95913Third Party Advisory, VDB Entry
• https://confluence.atlassian.com/adminjira/jira-platform-releases/jira-7-2-x-platform-release-notes#JIRA7.2.xplatformreleasenotes-7-2-2Release Notes
• https://jira.atlassian.com/browse/JRA-61888?src=confmacro&_ga=1.139403892.63283854.1485351777Exploit, Vendor Advisory

Published

Jan 31, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6271The Bzrtp library (aka libbzrtp) 1.0.x before 1.0.4 allows m…
• CVE-2016-6272XPath injection vulnerability in Epic MyChart allows remote …
• CVE-2016-6273The lmadmin component in Flexera FlexNet Publisher (aka Flex…
• CVE-2016-6276Citrix Linux Virtual Delivery Agent (aka VDA, formerly Linux…
• CVE-2016-6277NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Bet…8.8
• CVE-2016-6283Cross-site scripting (XSS) vulnerability in Atlassian Conflu…
• CVE-2016-6286The "spiffy-cgi-handlers" egg would convert a nonexistent "P…
• CVE-2016-6287The "http-client" egg always used a HTTP_PROXY environment v…
• CVE-2016-6288The php_url_parse_ex function in ext/standard/url.c in PHP b…
• CVE-2016-6289Integer overflow in the virtual_file_ex function in TSRM/tsr…
• CVE-2016-6290ext/session/session.c in PHP before 5.5.38, 5.6.x before 5.6…
• CVE-2016-6291The exif_process_IFD_in_MAKERNOTE function in ext/exif/exif.…