CVE-2016-9993

IBM Kenexa LCMS Premier on Cloud is vulnerable to SQL injection (CVE-2016-9993) affecting 9.0 through 10.2. An attacker could exfiltrate or modify data via specially crafted SQL statements. The IBM security bulletin lists affected versions up to 10.2 and provides a fix in LCMS Premier on Cloud 10...

CVE-2016-9992

IBM Kenexa LCMS Premier on Cloud (9.0 and 10.0.0) is affected by a SQL injection vulnerability. A remote attacker could craft SQL statements to view, add, modify, or delete data in the back-end database. IBM has addressed these issues in LCMS Premier on Cloud 10.3; affected customers should upgra...

CVE-2016-9994

IBM Kenexa LCMS Premier on Cloud 9.0 and 10.0.0 are affected by a SQL injection vulnerability (CVE-2016-9994). A remote attacker could submit specially crafted SQL statements to view, add, modify, or delete data in the back-end database. The issue has been addressed by IBM in LCMS Premier on Clou...

CVE-2016-5952

IBM Kenexa LCMS Premier on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database...

CVE-2016-5948

IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2016-5937

IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2016-5948

IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2016-5937

IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2016-5951

IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2016-5952

IBM Kenexa LCMS Premier on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database...

Cross site request forgery (csrf)

IBM Kenexa LCMS Premier on Cloud could allow an authenticated user to obtain sensitive user data with a specially crafted HTTP request...

Cross site scripting

IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2016-5951

IBM Kenexa LCMS Premier on Cloud is affected by CVE-2016-5951, a cross-site scripting vulnerability in the Web UI that could allow an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. The IBM Security Bulletin (A60098...) documents affected vers...

CVE-2016-5949

CVE-2016-5949 affects IBM Kenexa LCMS Premier on Cloud. An authenticated user could obtain sensitive user data via a specially crafted HTTP request. IBM's bulletin indicates the issue is addressed in LCMS Premier 10.1, with affected versions listed as 9.1–10.1. Remediation is to upgrade to the fi...

CVE-2016-5950

CVE-2016-5950 affects IBM Kenexa LCMS Premier on Cloud. The vulnerability is that credentials are stored in plain text and could be read by an authenticated user, exposing sensitive information. The incident is documented with a CVSS3.0 base score of 6.5 (C:H/I:N/A:N) and CVSS2.0 base score 4.0 (...

CVE-2016-5937

CVE-2016-5937 affects IBM Kenexa LCMS Premier on Cloud. The IBM Security Bulletin (A60098C4… 2018) details a Cross‑Site Request Forgery (CSRF) vulnerability that could allow an attacker to perform malicious, unauthorized actions on behalf of a trusted user. Affected versions include LCMS Premier ...

CVE-2016-5952

CVE-2016-5952 affects IBM Kenexa LCMS Premier on Cloud, with a SQL injection flaw that could let an attacker view, add, modify, or delete data in the back-end DB. The IBM Security Bulletin (LCMS Premier on Cloud 10.1) lists affected versions 9.0 through 10.0 and states the issue has been addresse...

CVE-2016-5948

CVE-2016-5948 affects IBM Kenexa LCMS Premier on Cloud. The vulnerability is a cross-site scripting flaw in the Web UI that could allow an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Documented CVSS v3.0 vector: CVSS:3.0/AV:N/AC:...

CVE-2016-5948

IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2016-5952

IBM Kenexa LCMS Premier on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database...