Threat database

PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.

Streamsoft Business Intelligence versions prior to 6.8.0.0 store user passwords in plaintext within the database. This vulnerability was addressed in version 6.8.0.0, and users were required to change their passwords upon first login after the update. The issue is classified under CWE-256, indicating improper storage of sensitive information.

Use of a custom token encoding algorithm in Streamsoft Prestiż software allows the value of the KSeF (Krajowy System e-Faktur) token to be guessed after analyzing how tokens with know values are encoded. This issue was fixed in version 20.0.380.92.