Ibm Concert vulnerabilities

CVE-2024-52367 [HIGH] CWE-497 CVE-2024-52367: IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could disclose sensitive system informa IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could disclose sensitive system information to an unauthorized actor that could be used in further attacks against the system.

CVE-2025-33102 [HIGH] CWE-327 CVE-2025-33102: IBM Concert Software 1.0.0 through 1.1.0 uses weaker than expected cryptographic algorithms that cou IBM Concert Software 1.0.0 through 1.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

CVE-2025-64645 [HIGH] CWE-367 CVE-2025-64645: IBM Concert 1.0.0 through 2.1.0 could allow a local user to escalate their privileges due to a race IBM Concert 1.0.0 through 2.1.0 could allow a local user to escalate their privileges due to a race condition of a symbolic link.

CVE-2025-33088 [HIGH] CWE-732 CVE-2025-33088: IBM Concert 1.0.0 through 2.1.0 could allow a local user with specific knowledge about the system's IBM Concert 1.0.0 through 2.1.0 could allow a local user with specific knowledge about the system's architecture to escalate their privileges due to incorrect file permissions for critical resources.

CVE-2025-33090 [HIGH] CWE-1333 CVE-2025-33090: IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to cause a denial of service IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resource consumption.

CVE-2024-55910 [MEDIUM] CWE-918 CVE-2024-55910: IBM Concert Software 1.0.0 through 1.0.5 is vulnerable to server-side request forgery (SSRF). This m IBM Concert Software 1.0.0 through 1.0.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

CVE-2024-43181 [MEDIUM] CWE-613 CVE-2024-43181: IBM Concert 1.0.0 through 2.1.0 does not invalidate session after logout which could allow an authen IBM Concert 1.0.0 through 2.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.

CVE-2024-51451 [MEDIUM] CWE-644 CVE-2024-51451: IBM Concert 1.0.0 through 2.1.0 is vulnerable to HTTP header injection, caused by improper validatio IBM Concert 1.0.0 through 2.1.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.

CVE-2024-55913 [MEDIUM] CWE-22 CVE-2024-55913: IBM Concert Software 1.0.0 through 1.0.5 could allow a remote attacker to traverse directories on th IBM Concert Software 1.0.0 through 1.0.5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

CVE-2024-37070 [MEDIUM] CWE-497 CVE-2024-37070: IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to obtain se IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to obtain sensitive information that could aid in further attacks against the system.

CVE-2025-33099 [MEDIUM] CWE-295 CVE-2025-33099: IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to perform unauthorized actio IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation.

CVE-2025-36085 [MEDIUM] CWE-918 CVE-2025-36085: IBM Concert 1.0.0 through 2.0.0 Software is vulnerable to server-side request forgery (SSRF). This m IBM Concert 1.0.0 through 2.0.0 Software is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

CVE-2025-36018 [MEDIUM] CWE-352 CVE-2025-36018: IBM Concert 1.0.0 through 2.1.0 for Z hub component is vulnerable to cross-site request forgery whic IBM Concert 1.0.0 through 2.1.0 for Z hub component is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

CVE-2025-64648 [MEDIUM] CWE-319 CVE-2025-64648: IBM Concert 1.0.0 through 2.2.0 transmits data in clear text that could allow an attacker to obtain IBM Concert 1.0.0 through 2.2.0 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.

CVE-2025-36161 [MEDIUM] CWE-327 CVE-2025-36161: IBM Concert 1.0.0 through 2.0.0 could allow a remote attacker to obtain sensitive information, cause IBM Concert 1.0.0 through 2.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict-Transport-Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.

CVE-2025-33101 [MEDIUM] CWE-244 CVE-2025-33101: IBM Concert 1.0.0 through 2.1.0 could allow an attacker to obtain sensitive information using man in IBM Concert 1.0.0 through 2.1.0 could allow an attacker to obtain sensitive information using man in the middle techniques due to improper clearing of heap memory.

CVE-2024-55912 [MEDIUM] CWE-327 CVE-2024-55912: IBM Concert Software 1.0.0 through 1.0.5 uses weaker than expected cryptographic algorithms that cou IBM Concert Software 1.0.0 through 1.0.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

CVE-2025-36153 [MEDIUM] CWE-79 CVE-2025-36153: IBM Concert 1.0.0 through 2.0.0 is vulnerable to cross-site scripting. This vulnerability allows an IBM Concert 1.0.0 through 2.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2025-36019 [MEDIUM] CWE-79 CVE-2025-36019: IBM Concert 1.0.0 through 2.1.0 for Z hub framework is vulnerable to cross-site scripting. This vuln IBM Concert 1.0.0 through 2.1.0 for Z hub framework is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2025-33084 [MEDIUM] CWE-327 CVE-2025-33084: IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to obtain sensitive informati IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.