Atlassian JIRA Server prior to 7.1.9 has XSS in project/ViewDefaultProjectRoleActors.jspa via a role name.
atlassian jira