{"cve":"CVE-2010-1164","nvd":{"published":"2010-04-20T15:30:00.507","modified":"2026-06-16T23:17:38.447","status":"Modified","description":"Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA 3.12 through 4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) element or (2) defaultColor parameter to the Colour Picker page; the (3) formName parameter, (4) element parameter, or (5) full name field to the User Picker page; the (6) formName parameter, (7) element parameter, or (8) group name field to the Group Picker page; the (9) announcement_preview_banner_st parameter to unspecified components, related to the Announcement Banner Preview page; unspecified vectors involving the (10) groupnames.jsp, (11) indexbrowser.jsp, (12) classpath-debug.jsp, (13) viewdocument.jsp, or (14) cleancommentspam.jsp page; the (15) portletKey parameter to runportleterror.jsp; the (16) URI to issuelinksmall.jsp; the (17) afterURL parameter to screenshot-redirecter.jsp; or the (18) HTTP Referrer header to 500page.jsp, as exploited in the wild in April 2010.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-79"],"references":["http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2010-04-16","http://jira.atlassian.com/browse/JRA-20994","http://jira.atlassian.com/browse/JRA-21004","http://secunia.com/advisories/39353","http://www.openwall.com/lists/oss-security/2010/04/16/3"],"products":["atlassian:jira"],"source":"nvd","synced_at":"2026-10-19T19:55:32.599380760+00:00"},"epss":{"cve":"CVE-2010-1164","score":0.02235,"percentile":0.82789,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}