CVE-2016-6126

IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...

CVE-2016-8912

IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 stores potentially sensitive information in in log files that could be read by an authenticated user...

CVE-2016-5939

IBM Kenexa LMS on Cloud is affected by SQL injection (CVE-2016-5939). Multiple connected sources confirm a vulnerability where a remote attacker can send specially crafted SQL statements to view, add, modify, or delete data in the back-end database. The IBM security bulletin notes affected versio...

CVE-2016-8911

The CVE-2016-8911 entry concerns IBM Kenexa LMS on Cloud (versions 13.1–13.2.4) where an attacker could cause a victim to hijack click actions by luring them to a malicious site, i.e., a clickjacking-style vulnerability that could enable further attacks in the victim’s session. Connected document...

CVE-2016-8920

CVE-2016-8920 affects IBM Kenexa LMS on Cloud (versions 13.1 and 13.2, up to 13.2.4). The issue is a cross-site scripting vulnerability that lets an attacker embed arbitrary JavaScript in the Web UI, potentially altering functionality and leading to credentials disclosure within a trusted session...

CVE-2016-8912

The CVE-2016-8912 entry applies to IBM Kenexa LMS on Cloud (versions 13.1–13.2; 13.2.4 specifically noted) where potentially sensitive information is stored in log files readable by authenticated users. The root cause involves information disclosure via log data. Impact is information disclosure ...

CVE-2016-6123

IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2016-6124

CVE-2016-6124 affects IBM Kenexa LMS on Cloud (versions 13.1–13.2; 13.2.4) where an unauthenticated? or remote attacker could upload arbitrary files, enabling arbitrary code execution on the vulnerable server. The IBM bulletin for LMS 5.0 on Cloud confirms remediation by updating to the latest fi...

CVE-2016-6123

IBM Kenexa LMS on Cloud versions 13.1–13.2.4 are affected by a cross-site scripting (XSS) vulnerability in the Web UI that can lead to credentials disclosure within a trusted session. The issue is addressed in LMS 5.0 on Cloud; IBM recommends upgrading to the latest fixed release. The provided so...

CVE-2016-6126

IBM Kenexa LMS on Cloud (versions 13.1–13.2.4) is affected by CVE-2016-6126 due to inadequate input validation that allows remote attackers to traverse directories via crafted URLs containing /.. sequences, enabling viewing arbitrary system files. The issue is a directory traversal in the web ser...

CVE-2016-8913

IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...

CVE-2016-5939: Improper Neutralization of Special Elements used in an SQL Command

IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database...

PT-2017-9861

Name of the Vulnerable Software and Affected Versions IBM Kenexa LMS on Cloud versions 13.1 through 13.2.4 Description The issue allows a remote attacker to traverse directories on the system by sending a specially-crafted URL request containing dot dot sequences ../ to view arbitrary files on th...

PT-2017-8910

Name of the Vulnerable Software and Affected Versions IBM Kenexa LMS on Cloud versions 13.1 through 13.2.4 Description The issue discloses answers to security questions in a response to authenticated users, potentially compromising the security of user accounts. Recommendations For versions 13.1...

PT-2017-8822

Name of the Vulnerable Software and Affected Versions IBM Kenexa LMS on Cloud affected versions not specified Description The issue allows a remote attacker to send specially-crafted SQL statements, potentially enabling them to view, add, modify, or delete information in the back-end database...

PT-2017-8914

Name of the Vulnerable Software and Affected Versions IBM Kenexa LMS on Cloud versions 13.1 through 13.2.4 Description The issue allows a remote attacker to traverse directories on the system by sending a specially-crafted URL request containing dot dot sequences ../ to view arbitrary files on th...

PT-2017-9877

Name of the Vulnerable Software and Affected Versions IBM Kenexa LMS on Cloud affected versions not specified Description The issue allows a remote attacker to upload arbitrary files, potentially enabling the execution of arbitrary code on the vulnerable server. Recommendations At the moment, the...

CVE-2016-8912: Insertion of Sensitive Information into Log File

IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 stores potentially sensitive information in in log files that could be read by an authenticated user...

CVE-2016-8933: Improper Limitation of a Pathname to a Restricted Directory

IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing dot dot sequences /../ to view arbitrary files on the system...

PT-2017-8825

Name of the Vulnerable Software and Affected Versions IBM Kenexa LMS on Cloud affected versions not specified Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...