We have identified and fixed a reflected cross-site scripting (XSS) vulnerability in the Bamboo chooseBuildsToMove resource.
This issue is reported in our security advisory on this page:
https://confluence.atlassian.com/x/rQP5FQ
You can read more about XSS attacks at:
http://www.cgisecurity.com/xss-faq.html
http://www.cert.org/advisories/CA-2000-02.html