Not rated
CVE-2016-5940 IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting
Description
IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Kenexa LMS on Cloud | 14.2.0 | No fix stated |
| Kenexa LMS on Cloud | 14.1.0 | No fix stated |
| Kenexa LMS on Cloud | 14.0.0 | No fix stated |
| Kenexa LMS on Cloud 13.2 | 13.2 → 13.2.4 | No fix stated |
| Kenexa LMS on Cloud | 13.1 | No fix stated |
| Kenexa LMS on Cloud | 13.0 | No fix stated |
Other CVEs of Kenexa LMS on Cloud
The 21 CVEs of Kenexa LMS on Cloud →
CVE-2016-8935
IBM Kenexa LMS on Cloud 13.1, 13.2, 13.2.2, 13.2.3, 13.2.4 and 14.0.0 are vulnerable to cross-site scripting
Not rated
CVE-2016-8933
IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system
Not rated
CVE-2016-8928
IBM Kenexa LMS on Cloud is vulnerable to SQL injection
Not rated
CVE-2016-8929
IBM Kenexa LMS on Cloud is vulnerable to SQL injection
Not rated