CVE-2017-1527

IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 130156.

• CWE-611

• http://www.ibm.com/support/docview.wss?uid=swg22007346Patch, Vendor Advisory
• http://www.securityfocus.com/bid/100959Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/130156VDB Entry, Vendor Advisory
• http://www.ibm.com/support/docview.wss?uid=swg22007346Patch, Vendor Advisory
• http://www.securityfocus.com/bid/100959Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/130156VDB Entry, Vendor Advisory

Published

Sep 26, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-15264IrfanView version 4.44 (32bit) allows attackers to cause a d…
• CVE-2017-15265Race condition in the ALSA subsystem in the Linux kernel bef…7
• CVE-2017-15266In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRAC…
• CVE-2017-15267In GNU Libextractor 1.4, there is a NULL Pointer Dereference…
• CVE-2017-15268Qemu through 2.10.0 allows remote attackers to cause a memor…
• CVE-2017-15269The PSFTPd 10.0.4 Build 729 server does not prevent FTP boun…
• CVE-2017-15270The PSFTPd 10.0.4 Build 729 server does not properly escape …
• CVE-2017-15271A use-after-free issue could be triggered remotely in the SF…
• CVE-2017-15272The PSFTPd 10.0.4 Build 729 server stores its configuration …
• CVE-2017-15273Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 be…
• CVE-2017-15274security/keys/keyctl.c in the Linux kernel before 4.11.5 doe…
• CVE-2017-15275Samba before 4.7.3 might allow remote attackers to obtain se…7.5