Ammarit Thongthua

The issue is related to insufficient input validation in the Diagnostics component of the Oracle Enterprise Command Center Framework. This can be exploited by a remote attacker to gain unauthorized access to protected information via the HTTP protocol. Successful attacks can result in unauthorized read access to a subset of accessible data.

A formula injection issue exists, allowing an authenticated remote attacker with administrative privileges to manipulate application form fields. This could trick another administrator into executing CSV payloads.

An arbitrary file write issue exists, allowing an authenticated, remote attacker with administrator privileges to alter logging variables. This could result in overwriting arbitrary files on the remote host with log data, potentially leading to a denial of service condition.

The issue is related to insufficient input validation in the MS Excel Specific component of Oracle Web Applications Desktop Integrator, part of the Oracle E-Business Suite. This vulnerability can be easily exploited by a low-privileged attacker with network access via HTTP, requiring human interaction from a person other than the attacker. Successful attacks can result in unauthorized update, insert, or delete access to some of Oracle Web Applications Desktop Integrator's accessible data, as well as unauthorized read access to a subset of the data. Additionally, it can cause a partial denial of service (partial DOS) of Oracle Web Applications Desktop Integrator.

The issue is related to insufficient input validation, which can be exploited by a remote attacker to elevate privileges to root or NT AUTHORITY/SYSTEM on the Nessus host. This can be achieved by executing a specially crafted file.

The issue concerns an arbitrary file deletion vulnerability that can be exploited using the Windows feature of NTFS called Symbolic links. Symbolic links can be created by any non-privileged user under some object directories. However, combining them with a different object, such as the NTFS junction point, allows for the exploitation. The SupportAssist clean files functionality does not distinguish junction points from the physical folder and proceeds to clean the target of the junction, allowing non-privileged users to create junction points and delete arbitrary files on the system that can be accessed only by the admin.

Name of the Vulnerable Software and Affected Versions: Intel(R) SSD Data Center Tool versions prior to 12/31/2020 Description: The issue is related to incorrect default permissions in the installer, which may allow an authenticated user to potentially enable escalation of privilege via local access. Recommendations: For versions downloaded before 12/31/2020, update the Intel(R) SSD Data Center Tool to a version released after 12/31/2020 to resolve the issue.

A vulnerability in the Network Access Manager and Web Security Agent components could allow an authenticated, local attacker to perform a DLL injection attack by exploiting insufficient validation of resources loaded by the application at run time. The attacker would need valid credentials on the Windows system. To exploit this, an attacker could insert a configuration file in a specific system path, causing a malicious DLL file to be loaded when the application starts, potentially allowing the execution of arbitrary code on the affected machine with SYSTEM privileges.

Name of the Vulnerable Software and Affected Versions: PeopleSoft Enterprise HCM Global Payroll Core version 9.2 Description: The issue is related to insufficient input validation in the Security component of the PeopleSoft Enterprise HCM Global Payroll Core application. This can be exploited by a remote attacker to gain unauthorized access to protected information, modify, add, or delete data, or cause a denial of service. The vulnerability can be easily exploited by a low-privileged attacker with network access via HTTP, allowing them to compromise the PeopleSoft Enterprise HCM Global Payroll Core product. Successful attacks can result in unauthorized access to some data, including read access to a subset of data and the ability to cause a partial denial of service. Recommendations: For version 9.2, update the Security component to a version that includes the necessary input validation checks to prevent exploitation. As a temporary workaround, consider restricting access to the Security component until a patch is available. Avoid using the HTTP protocol to access the PeopleSoft Enterprise HCM Global Payroll Core product until the issue is resolved.

The issue allows an authenticated user to impersonate another user on the system because the session is not invalidated after logout.

The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session. This is due to a cross-site scripting issue.

The issue is related to insufficient input validation in the Portal component of Oracle PeopleSoft Enterprise PeopleTools. This allows an unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools, resulting in unauthorized read access to a subset of accessible data.

The issue is related to insufficient input validation in the Environment Mgmt Console component. It allows a high-privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools, resulting in unauthorized update, insert, or delete access to some accessible data. The vulnerability can be easily exploited and may cause the application to become unresponsive or allow unauthorized data access.

The issue is related to incorrect default permissions, allowing a locally authenticated low-privileged malicious user to exploit it and run an arbitrary executable with administrative privileges on the affected system.

An issue was discovered in the integrated PostgreSQL component of ManageEngine Applications Manager, where a lack of file permission security allows malicious users in the "Authenticated Users" group to exploit privilege escalation. This can lead to modification of the PostgreSQL configuration, enabling the execution of arbitrary commands to gain full system privilege user access and rights over the system.

A Cross-Site Scripting (XSS) issue in the Web UI of Avaya Aura Conferencing may allow code execution and potentially disclose sensitive information.

The issue is related to insufficient sanitization and validation of user input before it is used as part of an HTTP header value, allowing the injection of arbitrary HTTP headers and response splitting.

The issue is related to a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks. This is due to the failure to properly handle CRLF sequences, allowing user-supplied data to be added to HTTP response headers without proper processing. As a result, an attacker can control HTTP response headers and bodies, potentially leading to cross-site scripting attacks and attacks on intermediate proxy servers.