Security Bulletin: IBM Kenexa LCMS Premier on Cloud is affected by a SQL Injection via External Service Interaction

Summary IBM Kenexa LCMS Premier on Cloud has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2017-1797 DESCRIPTION: IBM LCMS Premier on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to...

IBM Kenexa LCMS Premier on Cloud Information Disclosure Vulnerability (CNVD-2017-04799)

IBM Kenexa LCMS Premier on Cloud is an adjustable Learning Content Management System LCMS for developing, maintaining, and delivering effective employee training from IBM USA. A security vulnerability exists in IBM Kenexa LCMS Premier on Cloud that stems from the program failing to set a security...

PT-2017-12002

Name of the Vulnerable Software and Affected Versions IBM Kenexa LCMS Premier on Cloud versions 9.x through 10.0 Description The issue is caused by the failure to set the secure flag for the session cookie in SSL mode, allowing a remote attacker to obtain sensitive information. An attacker could...

CVE-2017-1142: Exposure of Sensitive Information to an Unauthorized Actor

IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to...

PT-2017-12007

Name of the Vulnerable Software and Affected Versions IBM Kenexa LCMS Premier on Cloud versions 9.x through 10.0 Description The issue is caused by the failure to properly enable HTTP Strict Transport Security, allowing a remote attacker to obtain sensitive information using man-in-the-middle...

PT-2017-10419

Name of the Vulnerable Software and Affected Versions IBM Kenexa LCMS Premier on Cloud versions 9.0 through 10.0.0 Description The issue allows a remote attacker to send specially-crafted SQL statements, potentially enabling them to view, add, modify, or delete information in the back-end databas...

CVE-2016-9993: Improper Neutralization of Special Elements used in an SQL Command

IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM Reference : 1992067...

CVE-2016-9992: Improper Neutralization of Special Elements used in an SQL Command

IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM Reference : 1992067...

CVE-2016-9994: Improper Neutralization of Special Elements used in an SQL Command

IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM Reference : 1976805...

PT-2017-10420

Name of the Vulnerable Software and Affected Versions IBM Kenexa LCMS Premier on Cloud versions 9.0 through 10.0.0 Description The issue allows a remote attacker to send specially-crafted SQL statements, potentially enabling them to view, add, modify, or delete information in the back-end databas...

PT-2017-10421

Name of the Vulnerable Software and Affected Versions IBM Kenexa LCMS Premier on Cloud versions 9.0 through 10.0.0 Description The issue allows a remote attacker to send specially-crafted SQL statements, potentially enabling them to view, add, modify, or delete information in the back-end databas...

CVE-2016-5952

IBM Kenexa LCMS Premier on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database...

Cross site request forgery (csrf)

IBM Kenexa LCMS Premier on Cloud could allow an authenticated user to obtain sensitive user data with a specially crafted HTTP request...

PT-2017-8826

Name of the Vulnerable Software and Affected Versions IBM Kenexa LCMS Premier on Cloud affected versions not specified Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within ...

PT-2017-8827

Name of the Vulnerable Software and Affected Versions IBM Kenexa LCMS Premier on Cloud affected versions not specified Description The issue allows an authenticated user to obtain sensitive user data by sending a specially crafted HTTP request. Recommendations At the moment, there is no informati...

PT-2017-8830

Name of the Vulnerable Software and Affected Versions IBM Kenexa LCMS Premier on Cloud affected versions not specified Description The issue allows a remote attacker to send specially-crafted SQL statements, potentially enabling them to view, add, modify, or delete information in the back-end...

CVE-2016-5950: Undefined Security Weakness

IBM Kenexa LCMS Premier on Cloud stores user credentials in plain in clear text which can be read by an authenticated user...

CVE-2016-5951: Improper Neutralization of Input During Web Page Generation

IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2016-5937: Cross-Site Request Forgery (CSRF)

IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2016-5952: Improper Neutralization of Special Elements used in an SQL Command

IBM Kenexa LCMS Premier on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database...