Kenexa Lms

Vendor:

First CVE: Feb 1, 2017 · Active for 9 years

11

Total CVEs

More Total CVEs than 90% of tracked products

11.0

Avg CVEs / Year

Higher CVE frequency than 97% of tracked products

6.3

Avg CVSS

Higher Avg CVSS than 31% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Kenexa Lms over time

Volume of CVEsAvg CVSS Base Score

First CVE

Feb 1, 2017

9 years ago

Most Recent CVE

Mar 31, 2017

3,406 days ago

CVE Severity & Scoring

Kenexa Lms11 CVEs

9%

55%

36%

All CVEs353,240 CVEs

45%

40%

11%

LowMediumHigh

Attack Vector

Local1 (9.1%)

Network10 (90.9%)

Unknown0 (0.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low11 (100.0%)

High0 (0.0%)

Unknown0 (0.0%)

User Interaction

None8 (72.7%)

Unknown0 (0.0%)

Required3 (27.3%)

Privileges Required

Low11 (100.0%)

High0 (0.0%)

None0 (0.0%)

Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (11 CVEs).

11 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2016-8932HIGH IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.	Feb 1, 2017	8.8	22	NO	NO
CVE-2016-8931HIGH IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.	Feb 1, 2017	8.8	22	NO	NO
CVE-2016-8935MEDIUM IBM Kenexa LMS on Cloud 13.1, 13.2, 13.2.2, 13.2.3, 13.2.4 and 14.0.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in	Mar 31, 2017	5.4	21	NO	NO
CVE-2016-8933MEDIUM IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing dot dot sequences (/.	Feb 1, 2017	6.5	21	NO	NO
CVE-2016-5941MEDIUM IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing dot dot sequences (/.	Feb 1, 2017	5.7	21	NO	NO
CVE-2016-5942MEDIUM IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functiona	Feb 1, 2017	5.4	20	NO	NO
CVE-2016-5940MEDIUM IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functiona	Feb 1, 2017	5.4	20	NO	NO
CVE-2016-8930HIGH IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete	Feb 1, 2017	7.6	19	NO	NO
CVE-2016-8928HIGH IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete	Feb 1, 2017	7.6	19	NO	NO
CVE-2016-8929MEDIUM IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete	Feb 1, 2017	5.4	16	NO	NO

View all 11 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (11 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

0 CVEs

0.0% of CVEs· Bottom 1%

Social Chatter

Signals from CVEs in this product scope (11 CVEs).

Media Mentions

Signals from CVEs in this product scope (11 CVEs).

Top CNAs Publishing CVEs For Kenexa Lms

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS
5.2	10	6.5	1.1%
5.1	10	6.5	1.1%
5.0	11	6.3	1.1%
4.2.4	11	6.3	1.1%
4.2.3	11	6.3	1.1%
4.2.2	11	6.3	1.1%
4.2	11	6.3	1.1%
4.1	11	6.3	1.1%