Description
The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the rendering of retrieved content from a url location that could be manipulated by the up_projectid widget preference setting.
Remediation
References
Related Vulnerabilities
Artifactory Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-65618)
PHP Integer Overflow or Wraparound Vulnerability (CVE-2016-3078)
Oracle Application Server Other Vulnerability (CVE-2001-1372)
Oracle Application Server CVE-2006-0289 Vulnerability (CVE-2006-0289)
Trac URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2008-2951)