{"id":"CVE-2025-1761","state":"PUBLISHED","title":"IBM Concert Software information disclosure","description":"IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory.","publishedAt":"2025-09-08T22:13:50.248Z","updatedAt":"2025-09-09T13:30:27.403Z","severity":{"score":5.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"ibm"},"assigner":"ibm","products":["IBM Concert Software"],"affected":[{"vendor":"IBM","product":"Concert Software","defaultStatus":"unaffected","versions":[{"version":"1.0.0","status":"affected","lessThanOrEqual":"1.1.0","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:concert:1.1.0:*:*:*:*:*:*:*"]}],"references":["https://www.ibm.com/support/pages/node/7244230"],"weaknesses":["CWE-824"],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/1xxx/CVE-2025-1761.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-1761","state":"PUBLISHED","datePublished":"2025-09-08T22:13:50.248Z","dateUpdated":"2025-09-09T13:30:27.403Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2025-02-27T16:33:31.328Z"},"containers":{"cna":{"title":"IBM Concert Software information disclosure","descriptions":[{"lang":"en","value":"IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory."}],"affected":[{"vendor":"IBM","product":"Concert Software","defaultStatus":"unaffected","versions":[{"version":"1.0.0","status":"affected","lessThanOrEqual":"1.1.0","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:concert:1.1.0:*:*:*:*:*:*:*"]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7244230","tags":["vendor-advisory","patch"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-824","description":"CWE-824 Improper Clearing of Heap Memory Before Release ('Heap Inspection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ibm","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateUpdated":"2025-09-08T22:13:50.248Z"},"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

IBM strongly recommends addressing the vulnerability now by upgrading to IBM Concert Software 2.0.0

Download IBM Concert Software 2.0.0 from Container software library section of IBM Entitled Registry (ICR) and follow installation instructions depending on the type of deployment.

\n\n
"}],"value":"IBM strongly recommends addressing the vulnerability now by upgrading to IBM Concert Software 2.0.0\n\nDownload IBM Concert Software 2.0.0 from Container software library section of IBM Entitled Registry ( ICR https://myibm.ibm.com/products-services/containerlibrary ) and follow installation instructions https://www.ibm.com/docs/en/concert  depending on the type of deployment."}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-09-09T13:15:37.932644Z","id":"CVE-2025-1761","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-09-09T13:30:27.403Z"}}]}}}