CVE-2016-8928
HighSummary
IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
Risk Assessment
The risk to the organization is the potential for unauthorized access to data, which could lead to a loss of confidentiality and integrity of information.
Recommendation
It is recommended to update the software to the latest version and implement safeguards against SQL injection attacks.
Other vulnerabilities in IBM Kenexa LMS on Cloud
See all- CVE-2016-8932High
IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.
- CVE-2016-8931High
IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.
- CVE-2016-8930High
IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
- CVE-2016-6124High
IBM Kenexa LMS on Cloud versions 13.1 and 13.2 - 13.2.4 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.
Original NVD description (English source)
IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.