CVE-2017-1424

IBM Business Process Manager 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127477.

• CWE-79

• http://www.ibm.com/support/docview.wss?uid=swg22005112Mitigation, Vendor Advisory
• http://www.securityfocus.com/bid/100962Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/127477VDB Entry, Vendor Advisory
• http://www.ibm.com/support/docview.wss?uid=swg22005112Mitigation, Vendor Advisory
• http://www.securityfocus.com/bid/100962Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/127477VDB Entry, Vendor Advisory

Published

Sep 25, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1423IBM WebSphere Portal 8.5 and 9.0 exposes backend server URLs…
• CVE-2017-14230In the mboxlist_do_find function in imap/mboxlist.c in Cyrus…
• CVE-2017-14231GeniXCMS before 1.1.0 allows remote attackers to cause a den…
• CVE-2017-14232The read_chunk function in flif-dec.cpp in Free Lossless Ima…
• CVE-2017-14238SQL injection vulnerability in admin/menus/edit.php in Dolib…
• CVE-2017-14239Multiple cross-site scripting (XSS) vulnerabilities in Dolib…
• CVE-2017-14240There is a sensitive information disclosure vulnerability in…
• CVE-2017-14241Cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM…
• CVE-2017-14242SQL injection vulnerability in don/list.php in Dolibarr vers…
• CVE-2017-14243An authentication bypass vulnerability on UTStar WA3002G4 AD…
• CVE-2017-14244An authentication bypass vulnerability on iBall Baton ADSL2+…9.8
• CVE-2017-14245An out of bounds read in the function d2alaw_array() in alaw…