CVE-2017-1494

IBM Business Process Manager 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128692.

• CWE-79

• http://www.ibm.com/support/docview.wss?uid=swg22008673Broken Link
• http://www.securityfocus.com/bid/102218Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040355Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/128692VDB Entry, Vendor Advisory
• http://www.ibm.com/support/docview.wss?uid=swg22008673Broken Link
• http://www.securityfocus.com/bid/102218Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040355Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/128692VDB Entry, Vendor Advisory

Published

Dec 20, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14933read_formatted_entries in dwarf2.c in the Binary File Descri…
• CVE-2017-14934process_debug_info in dwarf.c in the Binary File Descriptor …
• CVE-2017-14935Pulse Secure Pulse One On-Premise 2.0.1649 and below does no…
• CVE-2017-14937The airbag detonation algorithm allows injury to passenger-c…
• CVE-2017-14938_bfd_elf_slurp_version_tables in elf.c in the Binary File De…
• CVE-2017-14939decode_line_info in dwarf2.c in the Binary File Descriptor (…
• CVE-2017-14940scan_unit_for_symbols in dwarf2.c in the Binary File Descrip…
• CVE-2017-14941Jaspersoft JasperReports 4.7 suffers from a saved credential…
• CVE-2017-14942Intelbras WRN 150 devices allow remote attackers to read the…
• CVE-2017-14943Trapeze TransitMaster is vulnerable to information disclosur…
• CVE-2017-14944Inedo ProGet before 4.7.14 does not properly address dangero…
• CVE-2017-14945Artifex GSView 6.0 Beta on Windows allows attackers to cause…