Security Vulnerabilities - CVEs Published In August 2025
BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and use them to log in to the database server. For example, when Control-M/Server on Windows has a database connection on, it runs 'DBUStatus.exe' frequently, which then calls 'dbu_connection_details.vbs' with the username, password, database hostname, and port written in cleartext, which can be seen in event and process logs in two separate locations. Fixed in PACTV.9.0.21.307.
CVSS Score
4.8
EPSS Score
0.0
Published
2025-08-07
In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 file, leading to information disclosure.
CVSS Score
6.6
EPSS Score
0.0
Published
2025-08-07
In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.
CVSS Score
8.1
EPSS Score
0.002
Published
2025-08-07
In GStreamer through 1.26.1, the subparse plugin's parse_subrip_time function may write data past the bounds of a stack buffer, leading to a crash.
CVSS Score
5.6
EPSS Score
0.001
Published
2025-08-07
In GStreamer through 1.26.1, the subparse plugin's subrip_unescape_formatting function may dereference a NULL pointer while parsing a subtitle file, leading to a crash.
CVSS Score
5.5
EPSS Score
0.0
Published
2025-08-07
In GStreamer through 1.26.1, the subparse plugin's tmplayer_parse_line function may dereference a NULL pointer while parsing a subtitle file, leading to a crash.
CVSS Score
5.6
EPSS Score
0.001
Published
2025-08-07
Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Microsoft Windows environment with the privileges of the authenticated user. Tyler Technologies deployed hardened remote Windows environment settings to all ERP Pro 9 SaaS customer environments as of 2025-08-01.
CVSS Score
5.3
EPSS Score
0.001
Published
2025-08-07
FoxCMS <=v1.2.5 is vulnerable to Code Execution in admin/template_file/editFile.html.
CVSS Score
9.8
EPSS Score
0.004
Published
2025-08-07
An Insecure Direct Object Reference (IDOR) in Sage DPW v2024_12_004 and below allows unauthorized attackers to access internal forms via sending a crafted GET request.
CVSS Score
5.3
EPSS Score
0.001
Published
2025-08-07
Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the patient_contact parameter in patientsearch.php.
CVSS Score
9.8
EPSS Score
0.001
Published
2025-08-07