Ibm Concert vulnerabilities

CVE-2025-64649 [MEDIUM] CWE-295 CVE-2025-64649: IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation.

CVE-2024-37070 [MEDIUM] CWE-497 CVE-2024-37070: IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to obtain se IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to obtain sensitive information that could aid in further attacks against the system.

CVE-2025-36018 [MEDIUM] CWE-352 CVE-2025-36018: IBM Concert 1.0.0 through 2.1.0 for Z hub component is vulnerable to cross-site request forgery whic IBM Concert 1.0.0 through 2.1.0 for Z hub component is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

CVE-2025-36084 [MEDIUM] CWE-327 CVE-2025-36084: IBM Concert 1.0.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow IBM Concert 1.0.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

CVE-2025-33099 [MEDIUM] CWE-295 CVE-2025-33099: IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to perform unauthorized actio IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation.

CVE-2025-36085 [MEDIUM] CWE-918 CVE-2025-36085: IBM Concert 1.0.0 through 2.0.0 Software is vulnerable to server-side request forgery (SSRF). This m IBM Concert 1.0.0 through 2.0.0 Software is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

CVE-2025-64648 [MEDIUM] CWE-319 CVE-2025-64648: IBM Concert 1.0.0 through 2.2.0 transmits data in clear text that could allow an attacker to obtain IBM Concert 1.0.0 through 2.2.0 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.

CVE-2026-4413 [MEDIUM] CWE-79 CVE-2026-4413: IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an un IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2025-33101 [MEDIUM] CWE-244 CVE-2025-33101: IBM Concert 1.0.0 through 2.1.0 could allow an attacker to obtain sensitive information using man in IBM Concert 1.0.0 through 2.1.0 could allow an attacker to obtain sensitive information using man in the middle techniques due to improper clearing of heap memory.

CVE-2024-55912 [MEDIUM] CWE-327 CVE-2024-55912: IBM Concert Software 1.0.0 through 1.0.5 uses weaker than expected cryptographic algorithms that cou IBM Concert Software 1.0.0 through 1.0.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

CVE-2026-15661 [MEDIUM] CWE-117 CVE-2026-15661: IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.

CVE-2026-6718 [MEDIUM] CWE-276 CVE-2026-6718: IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized m IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files.

CVE-2026-6544 [MEDIUM] CWE-552 CVE-2026-6544: IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls whic IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls which can lead to unintentional inclusion of sensitive or unnecessary files and increased attack surface.

CVE-2025-36019 [MEDIUM] CWE-79 CVE-2025-36019: IBM Concert 1.0.0 through 2.1.0 for Z hub framework is vulnerable to cross-site scripting. This vuln IBM Concert 1.0.0 through 2.1.0 for Z hub framework is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2025-36161 [MEDIUM] CWE-327 CVE-2025-36161: IBM Concert 1.0.0 through 2.0.0 could allow a remote attacker to obtain sensitive information, cause IBM Concert 1.0.0 through 2.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict-Transport-Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.

CVE-2025-12767 [MEDIUM] CWE-770 CVE-2025-12767: IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a s IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resource consumption.

CVE-2026-3628 [MEDIUM] CWE-209 CVE-2026-3628: IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions. IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions.

CVE-2024-55909 [MEDIUM] CWE-409 CVE-2024-55909: IBM Concert Software 1.0.0 through 1.0.5 could allow an authenticated user to cause a denial of serv IBM Concert Software 1.0.0 through 1.0.5 could allow an authenticated user to cause a denial of service due to the expansion of archive files without controlling resource consumption.

CVE-2025-13044 [MEDIUM] CWE-340 CVE-2025-13044: IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local u IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack.

CVE-2024-41785 [MEDIUM] CWE-79 CVE-2024-41785: IBM Concert Software 1.0.0 through 1.0.1 is vulnerable to cross-site scripting. This vulnerability a IBM Concert Software 1.0.0 through 1.0.1 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.