Ibm Concert
65 CVEs affecting Ibm Concert. Latest disclosed: 2026-04-07. Critical: 0, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-33015 | High | 8.8 | 2026-01-20 | IBM Concert 1.0.0 through 2.1.0 is vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. |
CVE-2025-12771 | High | 7.8 | 2025-12-26 | IBM Concert 1.0.0 through 2.1.0 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and… |
CVE-2025-64645 | High | 7.7 | 2025-12-26 | IBM Concert 1.0.0 through 2.1.0 could allow a local user to escalate their privileges due to a race condition of a symbolic link. |
CVE-2024-52360 | High | 7.6 | 2024-11-19 | IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which coul… |
CVE-2025-33090 | High | 7.5 | 2025-08-18 | IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cau… |
CVE-2025-33088 | High | 7.4 | 2026-02-17 | IBM Concert 1.0.0 through 2.1.0 could allow a local user with specific knowledge about the system's architecture to escalate their privileges due to incorrect… |
CVE-2025-33089 | Medium | 6.5 | 2026-02-17 | IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information or perform unauthorized actions due to the use of hard coded user… |
CVE-2025-36018 | Medium | 6.5 | 2026-02-17 | IBM Concert 1.0.0 through 2.1.0 for Z hub component is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthor… |
CVE-2024-51451 | Medium | 6.5 | 2026-02-04 | IBM Concert 1.0.0 through 2.1.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attack… |
CVE-2024-55910 | Medium | 6.5 | 2025-05-02 | IBM Concert Software 1.0.0 through 1.0.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized req… |
CVE-2024-55909 | Medium | 6.5 | 2025-05-02 | IBM Concert Software 1.0.0 through 1.0.5 could allow an authenticated user to cause a denial of service due to the expansion of archive files without controlli… |
CVE-2024-43181 | Medium | 6.3 | 2026-02-04 | IBM Concert 1.0.0 through 2.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. |
CVE-2025-36149 | Medium | 6.3 | 2025-11-21 | IBM Concert Software 1.0.0 through 2.0.0 could allow a remote attacker to hijack the clicking action of the victim. |
CVE-2025-13044 | Medium | 6.2 | 2026-04-07 | IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack. |
CVE-2025-64646 | Medium | 6.2 | 2026-03-25 | IBM Concert 1.0.0 through 2.2.0 could allow an attacker to access sensitive information in memory due to the buffer not properly clearing resources. |
CVE-2025-12708 | Medium | 6.2 | 2026-03-25 | IBM Concert 1.0.0 through 2.2.0 contains hard-coded credentials that could be obtained by a local user. |
CVE-2025-36154 | Medium | 6.2 | 2025-12-24 | IBM Concert 1.0.0 through 2.1.0 stores sensitive information in cleartext during recursive docker builds which could be obtained by a local user. |
CVE-2025-36159 | Medium | 6.2 | 2025-11-20 | IBM Concert 1.0.0 through 2.0.0 could allow a local user to forge log files to impersonate other users or hide their identity due to improper neutralization of… |
CVE-2025-36083 | Medium | 6.2 | 2025-10-28 | IBM Concert Software 1.0.0 through 2.0.0 could allow a local user to obtain sensitive information from buffers due to improper clearing of heap memory before… |
CVE-2025-33100 | Medium | 6.2 | 2025-08-18 | IBM Concert Software 1.0.0 through 1.1.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authenti… |