Security Vulnerabilities
Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions as well as in newer versions which were upgraded from an affected version. These files contain keys and passwords relating to SSL files, keystore and policies. An attacker with local access to the system running the Agent can access these files.
CVSS Score
5.5
EPSS Score
0.0
Published
2025-09-16
An authentication bypass vulnerability exists in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions when using an empty or default kdb keystore or a default PKCS#12 keystore. A remote attacker with access to a signed third-party or demo certificate for client authentication can bypass the need for a certificate signed by the certificate authority of the organization during authentication on the Control-M/Agent.
The Control-M/Agent contains hardcoded certificates which are only trusted as fallback if an empty kdb keystore is used; they are never trusted if a PKCS#12 keystore is used. All of these certificates are now expired.
In addition, the Control-M/Agent default kdb and PKCS#12 keystores contain trusted third-party certificates (external recognized CAs and default self-signed demo certificates) which are trusted for client authentication.
CVSS Score
9.0
EPSS Score
0.001
Published
2025-09-16
Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.
CVSS Score
8.8
EPSS Score
0.0
Published
2025-09-16
This vulnerability affects Firefox < 143 and Thunderbird < 143.
CVSS Score
8.1
EPSS Score
0.0
Published
2025-09-16
This vulnerability affects Firefox < 143.
CVSS Score
7.5
EPSS Score
0.0
Published
2025-09-16
This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.
CVSS Score
6.2
EPSS Score
0.0
Published
2025-09-16
This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.
CVSS Score
6.5
EPSS Score
0.0
Published
2025-09-16
This vulnerability affects Firefox < 143, Firefox ESR < 115.28, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.
CVSS Score
8.8
EPSS Score
0.001
Published
2025-09-16
This vulnerability affects Firefox < 143 and Thunderbird < 143.
CVSS Score
6.5
EPSS Score
0.0
Published
2025-09-16
This vulnerability affects Firefox < 143 and Thunderbird < 143.
CVSS Score
5.4
EPSS Score
0.0
Published
2025-09-16