IBM Kenexa Lms On Cloud vulnerabilities

10 CVEs affecting IBM Kenexa Lms On Cloud, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-8920, published 2017-02-01.

More from IBM.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2016-6124, published 2017-02-01. High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days. IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.
• CVE-2016-8913, published 2017-02-01. Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days. IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot"…
• CVE-2016-6126, published 2017-02-01. Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days. IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot"…
• CVE-2016-8912, published 2017-02-01. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 stores potentially sensitive information in in log files that could be read by an authenticated user.
• CVE-2016-5939, published 2017-02-01. Medium severity, CVSS 6.3. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the…
• CVE-2016-6122, published 2017-02-01. Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 discloses answers to security questions in a response to authenticated users.
• CVE-2016-8911, published 2017-02-01. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could…
• CVE-2016-8920, published 2017-02-01. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
• CVE-2016-6125, published 2017-02-01. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
• CVE-2016-6123, published 2017-02-01. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…