Ibm Concert vulnerabilities

CVE-2025-13044 [MEDIUM] CWE-340 CVE-2025-13044: IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local u IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack.

CVE-2025-64647 [MEDIUM] CWE-1240 CVE-2025-64647: IBM Concert 1.0.0 through 2.2.0 uses weaker than expected cryptographic algorithms that could allow IBM Concert 1.0.0 through 2.2.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information

CVE-2025-64648 [MEDIUM] CWE-319 CVE-2025-64648: IBM Concert 1.0.0 through 2.2.0 transmits data in clear text that could allow an attacker to obtain IBM Concert 1.0.0 through 2.2.0 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.

CVE-2025-64646 [MEDIUM] CWE-14 CVE-2025-64646: IBM Concert 1.0.0 through 2.2.0 could allow an attacker to access sensitive information in memory du IBM Concert 1.0.0 through 2.2.0 could allow an attacker to access sensitive information in memory due to the buffer not properly clearing resources.

CVE-2025-12708 [MEDIUM] CWE-798 CVE-2025-12708: IBM Concert 1.0.0 through 2.2.0 contains hard-coded credentials that could be obtained by a local us IBM Concert 1.0.0 through 2.2.0 contains hard-coded credentials that could be obtained by a local user.

CVE-2025-36440 [MEDIUM] CWE-522 CVE-2025-36440: IBM Concert 1.0.0 through 2.2.0 could allow a local user to obtain sensitive information due to miss IBM Concert 1.0.0 through 2.2.0 could allow a local user to obtain sensitive information due to missing function level access control.

CVE-2025-36438 [MEDIUM] CWE-923 CVE-2025-36438: IBM Concert 1.0.0 through 2.2.0 could allow a privileged user to perform unauthorized actions due to IBM Concert 1.0.0 through 2.2.0 could allow a privileged user to perform unauthorized actions due to improper restriction of channel communication to intended endpoints.

CVE-2025-33089 [MEDIUM] CWE-798 CVE-2025-33089: IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information or per IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information or perform unauthorized actions due to the use of hard coded user credentials.

CVE-2025-33088 [HIGH] CWE-732 CVE-2025-33088: IBM Concert 1.0.0 through 2.1.0 could allow a local user with specific knowledge about the system's IBM Concert 1.0.0 through 2.1.0 could allow a local user with specific knowledge about the system's architecture to escalate their privileges due to incorrect file permissions for critical resources.

CVE-2024-43178 [MEDIUM] CWE-327 CVE-2024-43178: IBM Concert 1.0.0 through 2.1.0 uses weaker than expected cryptographic algorithms that could allow IBM Concert 1.0.0 through 2.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

CVE-2025-36019 [MEDIUM] CWE-79 CVE-2025-36019: IBM Concert 1.0.0 through 2.1.0 for Z hub framework is vulnerable to cross-site scripting. This vuln IBM Concert 1.0.0 through 2.1.0 for Z hub framework is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2025-33101 [MEDIUM] CWE-244 CVE-2025-33101: IBM Concert 1.0.0 through 2.1.0 could allow an attacker to obtain sensitive information using man in IBM Concert 1.0.0 through 2.1.0 could allow an attacker to obtain sensitive information using man in the middle techniques due to improper clearing of heap memory.

CVE-2025-36018 [MEDIUM] CWE-352 CVE-2025-36018: IBM Concert 1.0.0 through 2.1.0 for Z hub component is vulnerable to cross-site request forgery whic IBM Concert 1.0.0 through 2.1.0 for Z hub component is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

CVE-2025-36243 [MEDIUM] CWE-918 CVE-2025-36243: IBM Concert 1.0.0 through 2.1.0 is vulnerable to server-side request forgery (SSRF). This may allow IBM Concert 1.0.0 through 2.1.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

CVE-2024-43181 [MEDIUM] CWE-613 CVE-2024-43181: IBM Concert 1.0.0 through 2.1.0 does not invalidate session after logout which could allow an authen IBM Concert 1.0.0 through 2.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.

CVE-2024-51451 [MEDIUM] CWE-644 CVE-2024-51451: IBM Concert 1.0.0 through 2.1.0 is vulnerable to HTTP header injection, caused by improper validatio IBM Concert 1.0.0 through 2.1.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.

CVE-2025-33081 [LOW] CWE-312 CVE-2025-33081: IBM Concert 1.0.0 through 2.1.0 stores potentially sensitive information in log files that could be IBM Concert 1.0.0 through 2.1.0 stores potentially sensitive information in log files that could be read by a local user.

CVE-2025-36253 [MEDIUM] CWE-759 CVE-2025-36253: IBM Concert 1.0.0 through 2.1.0 uses weaker than expected cryptographic algorithms that could allow IBM Concert 1.0.0 through 2.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

CVE-2025-1722 [MEDIUM] CWE-244 CVE-2025-1722: IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from a IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory.

CVE-2025-1719 [MEDIUM] CWE-244 CVE-2025-1719: IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from a IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory.