CVE-2017-16864

The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the orderby parameter.

• CWE-79

• http://www.securityfocus.com/bid/102505Third Party Advisory, VDB Entry
• https://jira.atlassian.com/browse/JRASERVER-66624Patch, Vendor Advisory
• http://www.securityfocus.com/bid/102505Third Party Advisory, VDB Entry
• https://jira.atlassian.com/browse/JRASERVER-66624Patch, Vendor Advisory

Published

Jan 12, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16858The 'crowd-application' plugin module (notably used by the G…
• CVE-2017-16859The review attachment resource in Atlassian Fisheye and Cruc…
• CVE-2017-16860The invalidRedirectUrl template in Atlassian Application Lin…
• CVE-2017-16861It was possible for double OGNL evaluation in certain redire…
• CVE-2017-16862The IncomingMailServers resource in Atlassian Jira before ve…
• CVE-2017-16863The PieChart gadget in Atlassian Jira before version 7.5.3 a…
• CVE-2017-16865The Trello importer in Atlassian Jira before version 7.6.1 a…
• CVE-2017-16866dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Script…
• CVE-2017-16867Amazon Key through 2017-11-16 mishandles Cloud Cam 802.11 de…
• CVE-2017-16868In SWFTools 0.9.2, the wav_convert2mono function in lib/wav.…
• CVE-2017-16869p_mach.cpp in UPX 3.94 allows remote attackers to cause a de…
• CVE-2017-16870The UpdraftPlus plugin through 1.13.12 for WordPress has SSR…