CVE-2017-1767

IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 136152.

• CWE-79

• http://www.ibm.com/support/docview.wss?uid=swg22012396Patch, Vendor Advisory
• http://www.securityfocus.com/bid/103679Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040623Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/136152VDB Entry, Vendor Advisory
• http://www.ibm.com/support/docview.wss?uid=swg22012396Patch, Vendor Advisory
• http://www.securityfocus.com/bid/103679Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040623Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/136152VDB Entry, Vendor Advisory

Published

Mar 30, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-17662Directory traversal in the HTTP server on Yawcam 0.2.6 throu…
• CVE-2017-17663The htpasswd implementation of mini_httpd before v1.28 and o…
• CVE-2017-17664A Remote Crash issue was discovered in Asterisk Open Source …
• CVE-2017-17665In Octopus Deploy before 4.1.3, the machine update process d…
• CVE-2017-17668Memory write mechanism in NCR S1 Dispenser controller before…
• CVE-2017-17669There is a heap-based buffer over-read in the Exiv2::Interna…5.5
• CVE-2017-17670In VideoLAN VLC media player through 2.2.8, there is a type …
• CVE-2017-17671vBulletin through 5.3.x on Windows allows remote PHP code ex…9.8
• CVE-2017-17672In vBulletin through 5.3.x, there is an unauthenticated dese…
• CVE-2017-17674BMC Remedy Mid Tier 9.1SP3 is affected by remote and local f…9.8
• CVE-2017-17675BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Rem…5.3
• CVE-2017-17677BMC Remedy 9.1SP3 is affected by authenticated code executio…8.8