Threat Intelligence Database

IBM Concert versions 1.0.0 through 2.2.0 have a vulnerability where temporary files are created with predictable names. This flaw allows local users to perform symlink attacks to overwrite arbitrary files. The vulnerability does not impact confidentiality or availability but can lead to integrity compromise. It has a CVSS 3.1 score of 6.2, indicating medium severity.

IBM Concert 1.0.0 through 2.2.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information

MediumVulnerabilityUnited StatesCanadaUnited Kingdom+7#cve#cve-2025-64647#cwe-1240

IBM Concert 1.0.0 through 2.2.0 could allow a local user to obtain sensitive information due to missing function level access control.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2025-36440#cwe-522

IBM Concert 1.0.0 through 2.2.0 could allow a privileged user to perform unauthorized actions due to improper restriction of channel communication to intended endpoints.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2025-36438#cwe-923

IBM Concert 1.0.0 through 2.2.0 contains hard-coded credentials that could be obtained by a local user.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2025-12708#cwe-798

CVE-2024-51451 is a medium severity vulnerability in IBM Concert versions 1.0.0 through 2.1.0 caused by improper validation of HOST headers, leading to HTTP header injection. This flaw allows attackers to perform cross-site scripting (XSS), cache poisoning, or session hijacking without requiring authentication or user interaction. The vulnerability impacts confidentiality and integrity but not availability. Exploitation is remotely feasible with low complexity. European organizations using IBM Concert, especially in countries with significant IBM enterprise deployments, are at risk. Mitigations include strict validation and sanitization of HOST headers, deploying web application firewalls with custom rules, and monitoring HTTP traffic for anomalies.

MediumVulnerabilityGermanyFranceNetherlands+3#cve#cve-2024-51451#cwe-644

CVE-2024-43181 is a medium severity vulnerability in IBM Concert versions 1.0.0 through 2.1.0 where sessions are not invalidated upon user logout. This insufficient session expiration (CWE-613) flaw allows an authenticated user to potentially impersonate another user by reusing a session token after logout. The vulnerability requires prior authentication but no user interaction beyond logout. Exploitation could lead to limited confidentiality, integrity, and availability impacts. No known exploits are currently reported in the wild. European organizations using IBM Concert should prioritize patching or implementing compensating controls to prevent session reuse.

MediumVulnerabilityGermanyFranceNetherlands+5#cve#cve-2024-43181#cwe-613

IBM Concert 1.0.0 through 2.1.0 stores potentially sensitive information in log files that could be read by a local user.

LowVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2025-33081#cwe-312

IBM Concert 1.0.0 through 2.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

MediumVulnerabilityGermanyUnited KingdomFrance+4#cve#cve-2025-36253#cwe-759

IBM Concert 1.0.0 through 2.1.0 is vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface.

HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2025-33015#cwe-434