Security Bulletin: IBM Kenexa LCMS Premier on Cloud is affected by Open Source Commons FileUpload Apache Vulnerabilities

Summary IBM Kenexa LCMS Premier on Cloud has addressed a vulnerability that could allow a remote attacker to execute arbitrary code on the system, caused by deserialization of untrusted data in DiskFileItem class of the FileUpload library. A remote attacker could exploit this vulnerability to...

Security Bulletin: Multiple Security Vulnerabilties have been addressed in LCMS Premier on Cloud 11.0

Summary Multiple Security Vulnerabilties have been addressed in LCMS Premier on Cloud 11.0 Vulnerability Details CVEID: CVE-2017-1142 DESCRIPTION: IBM Kenexa LCMS Premier on Cloud could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the...

Security Bulletin: IBM Kenexa LCMS Premier on Cloud has addressed (CVE-2016-5949)

Summary IBM Kenexa LCMS Premier on Cloud 10.1 has addressed a vulnerability that could allow an authenticated user to obtain sensitive user data with specically crafted HTTP request Vulnerability Details CVEID: CVE-2016-5949 DESCRIPTION: IBM Kenexa LCMS Premier on Cloud could allow an authenticat...

Security Bulletin: Multiple Security Vulnerabilities have been addressed in LCMS Premier 10.3

Summary Multiple Security Vulnerabilties have been addressed in LCMS Premier on Cloud 10.3 Vulnerability Details CVEID: CVE-2016-5948 DESCRIPTION: IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web ...

Security Bulletin: A vulnerability in Open Source BeanShell has been addressed by IBM Kenexa LCMS Premier (CVE-2016-2510)

Summary A vulnerability in Open Source BeanShell has been addressed by LCMS Premier Vulnerability Details CVEID: CVE-2016-2510 DESCRIPTION: BeanShell could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data using Java serialization or...

Security Bulletin: Multiple Security Vulnerabilities have been addressed in LCMS Premier on Cloud 10.1

Summary Multiple Security Vulnerabilities have been addressed in LCMS Premier on Cloud 10.1 Vulnerability Details Relevant CVE Information: CVEID: CVE-2016-5952 DESCRIPTION: IBM Kenexa LCMS Premier on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL...

Atutor Directory Traversal Vulnerability

ATutor is an open source Web-based learning content management system LCMS developed by the ATutor team. The system includes teaching content management, forums, chat rooms and other modules. A directory traversal vulnerability exists in Atutor 2.2.1 and earlier versions. An attacker can exploit...

lcms: Heap-use-after-free in TetrahedralInterpFloat

Project: https://github.com/mm2/Little-CMS.git Detailed report: https://oss-fuzz.com/testcase?key=4660696417566720 Project: lcms Fuzzer: afllcmscmstransformfuzzer Fuzz target binary: cmstransformfuzzer Job Type: aflasanlcms Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address:...

lcms: Heap-buffer-overflow in TetrahedralInterpFloat

Project: https://github.com/mm2/Little-CMS.git Detailed report: https://oss-fuzz.com/testcase?key=4857091871211520 Project: lcms Fuzzer: afllcmscmstransformfuzzer Fuzz target binary: cmstransformfuzzer Job Type: aflasanlcms Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

IBM Kenexa LCMS Premier on Cloud Information Disclosure Vulnerability (CNVD-2017-04799)

IBM Kenexa LCMS Premier on Cloud is an adjustable Learning Content Management System LCMS for developing, maintaining, and delivering effective employee training from IBM USA. A security vulnerability exists in IBM Kenexa LCMS Premier on Cloud that stems from the program failing to set a security...

Information disclosure

IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IB...

Information disclosure

IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to...

CVE-2017-1142

IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to...

CVE-2017-1143

IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IB...

CVE-2017-1143

IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IB...

CVE-2017-1142

IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to...

CVE-2017-1142

CVE-2017-1142 affects IBM Kenexa LCMS Premier on Cloud (versions 9.x and 10.x, including 9.1–9.5, 10.0, 10.2, 10.3). The root cause is failure to set the secure flag for the session cookie in SSL mode, enabling an attacker to intercept HTTP traffic and capture the cookie to obtain sensitive infor...

CVE-2017-1143

IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IB...

CVE-2017-1143

CVE-2017-1143 affects IBM Kenexa LCMS Premier on Cloud 9.1–10.3. Root cause: failure to properly enable HTTP Strict Transport Security, enabling a remote attacker to obtain sensitive information via MITM. Impact: information disclosure (CVSS v3 base 5.3, MEDIUM). Exploitation details are not prov...

lcms: Heap-buffer-overflow in TetrahedralInterpFloat

Project: https://github.com/mm2/Little-CMS.git Detailed report: https://oss-fuzz.com/testcase?key=5036643692052480 Project: lcms Fuzzer: afllcmscmstransformfuzzer Fuzz target binary: cmstransformfuzzer Job Type: aflasanlcms Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...