However, I am still investigating the original issue (JST-80496) but it seems there is a potential for XSS in Dashboard Gadgets.
I was able to reproduce this on Firefox, Linux:

So, access JIRA and login. Open a new tab and access the treasury.gov site. Use this same tab that has the treasury site opened to access JIRA.

From my current investigation:

• treasury.gov stores some user tracking data in window.name JS parameter. its value is passed across visits (and sites opened in the same tab)
• gadgets are reading values from window.name and somehow its content is injected to the page

cc: ohernandez@atlassian.com