IBM Concert vulnerabilities

IBM Concert versions 1.0.0 through 2.1.0 is vulnerable to malicious file upload due to lack of content validation for files uploaded to the web interface. An attacker could exploit this to upload harmful files.

IBM Concert versions 1.0.0 through 2.3.1 are vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, potentially allowing viewing, adding, modifying, or deleting information in the back-end database.

IBM Concert versions 1.0.0 through 2.3.1 may allow a remote attacker to perform unauthorized actions using man-in-the-middle techniques due to improper certificate validation.

IBM Concert versions 1.0.0 through 2.2.0 creates temporary files with predictable names. A local user can exploit a symlink attack to overwrite arbitrary files.