Security Bulletin: IBM Kenexa LCMS Premier on Cloud is affected by Open Source Commons FileUpload Apache Vulnerabilities

Summary IBM Kenexa LCMS Premier on Cloud has addressed a vulnerability that could allow a remote attacker to execute arbitrary code on the system, caused by deserialization of untrusted data in DiskFileItem class of the FileUpload library. A remote attacker could exploit this vulnerability to...

Security Bulletin: A cross-site scripting vulnerablity has been addressed in IBM Kenexa LMS on Cloud 5.1

Summary A cross-site scripting vulnerablity has been addressed in IBM Kenexa LMS on Cloud 5.1 Vulnerability Details CVEID: CVE-2016-8935 DESCRIPTION: IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu...

Security Bulletin: Multiple Security Vulnerabilties have been addressed in LCMS Premier on Cloud 11.0

Summary Multiple Security Vulnerabilties have been addressed in LCMS Premier on Cloud 11.0 Vulnerability Details CVEID: CVE-2017-1142 DESCRIPTION: IBM Kenexa LCMS Premier on Cloud could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the...

Security Bulletin: Multiple security vulnerabilities have been addressed in LMS 5.0 on Cloud

Summary Multiple security vulnerabilities have been addressed in LMS 5.0 on Cloud Vulnerability Details CVEID: CVE-2016-6126 DESCRIPTION: IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing...

Security Bulletin: IBM Kenexa LCMS Premier on Cloud has addressed (CVE-2016-5949)

Summary IBM Kenexa LCMS Premier on Cloud 10.1 has addressed a vulnerability that could allow an authenticated user to obtain sensitive user data with specically crafted HTTP request Vulnerability Details CVEID: CVE-2016-5949 DESCRIPTION: IBM Kenexa LCMS Premier on Cloud could allow an authenticat...

Security Bulletin: An SQL Injection has been addressed in LMS 5.2 Patch

Summary IBM Kenexa LMS on Cloud addressed a vulnerable which could allow a remote attacker to send specially-crafted SQL statements, which could allow them to view, add, modify or delete information in the back-end database. Vulnerability Details CVEID: CVE-2016-5939 DESCRIPTION: IBM Kenexa LMS o...

Security Bulletin: Multiple Security Vulnerabilities have been addressed in LMS 6.0 on Cloud

Summary Multiple Security Vulnerabilities have been addressed in LMS 6.0 on Cloud Vulnerability Details CVEID: CVE-2016-5938 DESCRIPTION: IBM Kenexa LMS on Cloud allows web pages to be stored locally which can be read by another user on the system. CVSS Base Score: 4 CVSS Temporal Score: See...

Security Bulletin: Multiple Security Vulnerabilities have been addressed in LCMS Premier 10.3

Summary Multiple Security Vulnerabilties have been addressed in LCMS Premier on Cloud 10.3 Vulnerability Details CVEID: CVE-2016-5948 DESCRIPTION: IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web ...

Security Bulletin: A vulnerability in Open Source BeanShell has been addressed by IBM Kenexa LMS (CVE-2016-2510)

Summary A vulnerability in Open Source BeanShell has been addressed by LMS Vulnerability Details CVEID: CVE-2016-2510 DESCRIPTION: BeanShell could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data using Java serialization or XStream. ...

Security Bulletin: A vulnerability in Open Source BeanShell has been addressed by IBM Kenexa LCMS Premier (CVE-2016-2510)

Summary A vulnerability in Open Source BeanShell has been addressed by LCMS Premier Vulnerability Details CVEID: CVE-2016-2510 DESCRIPTION: BeanShell could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data using Java serialization or...

Security Bulletin: Multiple Security Vulnerabilities have been addressed in LCMS Premier on Cloud 10.1

Summary Multiple Security Vulnerabilities have been addressed in LCMS Premier on Cloud 10.1 Vulnerability Details Relevant CVE Information: CVEID: CVE-2016-5952 DESCRIPTION: IBM Kenexa LCMS Premier on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL...

Cross site scripting

IBM Kenexa LMS on Cloud 13.1, 13.2, 13.2.2, 13.2.3, 13.2.4 and 14.0.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2016-8935

IBM Kenexa LMS on Cloud 13.1, 13.2, 13.2.2, 13.2.3, 13.2.4 and 14.0.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2016-8935

IBM Kenexa LMS on Cloud 13.1, 13.2, 13.2.2, 13.2.3, 13.2.4 and 14.0.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2016-8935

IBM Kenexa LMS on Cloud 13.1, 13.2, 13.2.2, 13.2.3, 13.2.4 and 14.0.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2016-8935

IBM Kenexa LMS on Cloud is affected by CVE-2016-8935: cross-site scripting that enables embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. Connected IBM bulletin details affected versions (including 4.1–5.0 family for on‑premise/c...

IBM Kenexa LCMS Premier on Cloud Information Disclosure Vulnerability (CNVD-2017-04799)

IBM Kenexa LCMS Premier on Cloud is an adjustable Learning Content Management System LCMS for developing, maintaining, and delivering effective employee training from IBM USA. A security vulnerability exists in IBM Kenexa LCMS Premier on Cloud that stems from the program failing to set a security...

IBM Kenexa LCMS Premier on Cloud Information Disclosure Vulnerability (CNVD-2017-04798)

IBM Kenexa LCMS Premier on Cloud is an adjustable Learning Content Management System LCMS for developing, maintaining, and delivering effective employee training from IBM USA. A security vulnerability exists in IBM Kenexa LCMS Premier on Cloud due to the program failing to properly enable HTTP...

Information disclosure

IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to...

CVE-2017-1143

IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IB...