Sittikorn Sangrattanapitak

Name of the Vulnerable Software and Affected Versions: Intel(R) SSD Data Center Tool versions prior to 12/31/2020 Description: The issue is related to incorrect default permissions in the installer, which may allow an authenticated user to potentially enable escalation of privilege via local access. Recommendations: For versions downloaded before 12/31/2020, update the Intel(R) SSD Data Center Tool to a version released after 12/31/2020 to resolve the issue.

A vulnerability in the Network Access Manager and Web Security Agent components could allow an authenticated, local attacker to perform a DLL injection attack by exploiting insufficient validation of resources loaded by the application at run time. The attacker would need valid credentials on the Windows system. To exploit this, an attacker could insert a configuration file in a specific system path, causing a malicious DLL file to be loaded when the application starts, potentially allowing the execution of arbitrary code on the affected machine with SYSTEM privileges.

The issue is related to incorrect default permissions, allowing a locally authenticated low-privileged malicious user to exploit it and run an arbitrary executable with administrative privileges on the affected system.

An issue was discovered in the integrated PostgreSQL component of ManageEngine Applications Manager, where a lack of file permission security allows malicious users in the "Authenticated Users" group to exploit privilege escalation. This can lead to modification of the PostgreSQL configuration, enabling the execution of arbitrary commands to gain full system privilege user access and rights over the system.