CVE-2025-36149
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
IBM Concert Software versions 1.0.0 through 2.0.0 could allow a remote attacker to hijack the clicking action of the victim, potentially leading to unintended actions on behalf of the user.
Risk Assessment
The risk includes the possibility of clickjacking attacks, which could result in unauthorized operations in the system or data theft.
Recommendation
It is recommended to update IBM Concert Software to a version newer than 2.0.0 and implement clickjacking protections such as X-Frame-Options headers.
Other vulnerabilities in IBM Concert Software
See all- CVE-2025-36083Medium
IBM Concert Software 1.0.0 through 2.0.0 could allow a local user to obtain sensitive information from buffers due to improper clearing of heap memory before release.
- CVE-2025-36081Medium
IBM Concert Software 1.0.0 through 2.0.0 could allow a user to modify system logs due to improper neutralization of log input.
- CVE-2025-1761Medium
IBM Concert Software versions 1.0.0 through 1.1.0 may allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory.
Original NVD description (English source)
IBM Concert Software 1.0.0 through 2.0.0 could allow a remote attacker to hijack the clicking action of the victim.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS