CVE-2017-16863

The PieChart gadget in Atlassian Jira before version 7.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a project or filter.

• CWE-79

• http://www.securityfocus.com/bid/102732Third Party Advisory, VDB Entry
• https://jira.atlassian.com/browse/JRASERVER-66623Issue Tracking, Vendor Advisory
• http://www.securityfocus.com/bid/102732Third Party Advisory, VDB Entry
• https://jira.atlassian.com/browse/JRASERVER-66623Issue Tracking, Vendor Advisory

Published

Jan 18, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16857It is possible to bypass the bitbucket auto-unapprove plugin…
• CVE-2017-16858The 'crowd-application' plugin module (notably used by the G…
• CVE-2017-16859The review attachment resource in Atlassian Fisheye and Cruc…
• CVE-2017-16860The invalidRedirectUrl template in Atlassian Application Lin…
• CVE-2017-16861It was possible for double OGNL evaluation in certain redire…
• CVE-2017-16862The IncomingMailServers resource in Atlassian Jira before ve…
• CVE-2017-16864The issue search resource in Atlassian Jira before version 7…
• CVE-2017-16865The Trello importer in Atlassian Jira before version 7.6.1 a…
• CVE-2017-16866dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Script…
• CVE-2017-16867Amazon Key through 2017-11-16 mishandles Cloud Cam 802.11 de…
• CVE-2017-16868In SWFTools 0.9.2, the wav_convert2mono function in lib/wav.…
• CVE-2017-16869p_mach.cpp in UPX 3.94 allows remote attackers to cause a de…