Nuttakorn Tungpoonsup

An information leakage vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message validation, allowing local unprivileged processes to send unauthorized queries. Additionally, a reply buffer used by the port message handler was not properly initialized before returning data, leaking residual kernel pool memory from prior allocations. A local unprivileged attacker could exploit this vulnerability to enumerate DLP configuration and feature flags, extract live session tokens, and read kernel memory fragments from other users' operations.

Name of the Vulnerable Software and Affected Versions: Intel(R) SSD Data Center Tool versions prior to 12/31/2020 Description: The issue is related to incorrect default permissions in the installer, which may allow an authenticated user to potentially enable escalation of privilege via local access. Recommendations: For versions downloaded before 12/31/2020, update the Intel(R) SSD Data Center Tool to a version released after 12/31/2020 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Application Control Plus versions prior to 100523 Description: The issue is related to an insecure SSL configuration setting for Nginx, which can lead to Privilege Escalation. Recommendations: For versions prior to 100523, update to version 100523 or later to resolve the issue.

A vulnerability in the Network Access Manager and Web Security Agent components could allow an authenticated, local attacker to perform a DLL injection attack by exploiting insufficient validation of resources loaded by the application at run time. The attacker would need valid credentials on the Windows system. To exploit this, an attacker could insert a configuration file in a specific system path, causing a malicious DLL file to be loaded when the application starts, potentially allowing the execution of arbitrary code on the affected machine with SYSTEM privileges.

The issue is related to incorrect default permissions, allowing a locally authenticated low-privileged malicious user to exploit it and run an arbitrary executable with administrative privileges on the affected system.

An issue was discovered in the integrated PostgreSQL component of ManageEngine Applications Manager, where a lack of file permission security allows malicious users in the "Authenticated Users" group to exploit privilege escalation. This can lead to modification of the PostgreSQL configuration, enabling the execution of arbitrary commands to gain full system privilege user access and rights over the system.