IBM Kenexa Lms vulnerabilities

11 CVEs affecting IBM Kenexa Lms, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-8935, published 2017-03-31.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-8932, published 2017-02-01. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.
CVE-2016-8931, published 2017-02-01. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.
CVE-2016-8933, published 2017-02-01. Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days. IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing dot dot sequences (/../) to view…
CVE-2016-5941, published 2017-02-01. Medium severity, CVSS 5.7. EPSS: 1.6% chance of exploitation in the next 30 days. IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing dot dot sequences (/../) to view…
CVE-2016-8930, published 2017-02-01. High severity, CVSS 7.6. EPSS: 1% chance of exploitation in the next 30 days. IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the…
CVE-2016-8928, published 2017-02-01. High severity, CVSS 7.6. EPSS: 1% chance of exploitation in the next 30 days. IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the…
CVE-2016-8929, published 2017-02-01. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the…
CVE-2016-5942, published 2017-02-01. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially…
CVE-2016-8935, published 2017-03-31. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Kenexa LMS on Cloud 13.1, 13.2, 13.2.2, 13.2.3, 13.2.4 and 14.0.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus…
CVE-2016-5940, published 2017-02-01. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially…