Threats affecting pkg:maven/com.ibm/concert

IBM Concert versions 1.0 through 3.0.0 contain a vulnerability where error messages disclose sensitive schema suggestion information. This information disclosure flaw is classified under CWE-209. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity level. No public exploits or known active exploitation have been reported. No patch or remediation details are provided in the available data.

IBM Concert versions 1.0 through 3.0.0 store web page cache locally, which can be accessed by other users on the same system, potentially exposing sensitive information.

IBM Concert versions 1.0 through 3.0.0 are affected by a cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject arbitrary JavaScript into the web interface, potentially altering functionality and leading to credential disclosure within trusted sessions. The vulnerability has a medium severity rating with a CVSS score of 6.1.

IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls which can lead to unintentional inclusion of sensitive or unnecessary files and increased attack surface.

IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources due to the use of wildcards in RBAC permission definitions.

IBM Concert 1.0.0 through 3.0.0 could allow a local attacker to obtain sensitive information due to recursive copying of build context directories into container images.

IBM Concert 1.0.0 through 2.2.0 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.

IBM Concert 1.0.0 through 2.2.0 could allow an attacker to access sensitive information in memory due to the buffer not properly clearing resources.