CVE-2017-1766

Due to incorrect authorization in IBM Business Process Manager 8.6 an attacker can claim and work on ad hoc tasks he is not assigned to. IBM X-Force ID: 136151.

• CWE-863

• http://www.ibm.com/support/docview.wss?uid=swg22011866Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/136151VDB Entry, Vendor Advisory
• http://www.ibm.com/support/docview.wss?uid=swg22011866Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/136151VDB Entry, Vendor Advisory

Published

Mar 30, 2018

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-17654This vulnerability allows remote attackers to execute arbitr…
• CVE-2017-17655This vulnerability allows remote attackers to execute arbitr…
• CVE-2017-17656This vulnerability allows remote attackers to execute arbitr…
• CVE-2017-17657This vulnerability allows remote attackers to execute arbitr…
• CVE-2017-17658This vulnerability allows remote attackers to execute arbitr…
• CVE-2017-17659This vulnerability allows remote attackers to execute arbitr…
• CVE-2017-17662Directory traversal in the HTTP server on Yawcam 0.2.6 throu…
• CVE-2017-17663The htpasswd implementation of mini_httpd before v1.28 and o…
• CVE-2017-17664A Remote Crash issue was discovered in Asterisk Open Source …
• CVE-2017-17665In Octopus Deploy before 4.1.3, the machine update process d…
• CVE-2017-17668Memory write mechanism in NCR S1 Dispenser controller before…
• CVE-2017-17669There is a heap-based buffer over-read in the Exiv2::Interna…5.5