Code injection

CREATIVE Pebble devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. The power indicator LED of the speakers is connected directly to the power line, as a result, the intensit...

CVE-2021-38546

The CVE-2021-38546 entry covers Creative Pebble devices affected by a Glowworm-style attack. According to redhat and NVD records, remote attackers can recover spoken audio by measuring power-indicator LED emissions with an electro-optical sensor and telescope. The underlying issue links LED outpu...

CVE-2021-38546

CREATIVE Pebble devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. The power indicator LED of the speakers is connected directly to the power line, as a result, the intensit...

PT-2021-22201

Name of the Vulnerable Software and Affected Versions CREATIVE Pebble devices through 2021-08-09 Description The issue allows remote attackers to recover speech signals from an LED on the device via a telescope and an electro-optical sensor, known as a "Glowworm" attack. This is possible because...

CVE-2021-38546: Undefined Security Weakness

CREATIVE Pebble devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. The power indicator LED of the speakers is connected directly to the power line, as a result, the intensit...

Pebble security vulnerabilities

Pebble is a customizable watch from the American company Pebble. Pebble suffers from a security vulnerability that stems from the device's ability to power an audio output device under certain specified usage scenarios. The vulnerability can be exploited by an attacker to recover voice signals fr...

Server-Side Template Injection

pebble is vulnerable to server-side template injection. The fix for an older vulnerability that validates for getClass can be bypassed to inject arbitrary code through the template using Java classes that have TYPE static field containing values that is an instance of java.lang.Class. For example...

Server-Side Template Injection

pebble is vulnerable to server-side template injection. The fix for an older vulnerability that validates for getClass can be bypassed to inject arbitrary code through the template using the java.lang.Class.forNamejava.lang.Module,java.lang.String signature, resulting in access to java.lang.Runti...

Server-Side Template Injection

pebble is vulnerable to server-side template injection. The allowGetClass validation can be bypassed due to lack case-sensitivity verification. An attacker is able to inject arbitrary code through the template using object.CLASS , object.Class or object.getclass...

CVE-2019-19899

Pebble Templates 3.1.2 allows attackers to bypass a protection mechanism intended to block access to instances of java.lang.Class because getClass is accessible via the public static java.lang.Class java.lang.Class.forNamejava.lang.Module,java.lang.String signature...

CVE-2019-19899

Pebble Templates 3.1.2 allows attackers to bypass a protection mechanism intended to block access to instances of java.lang.Class because getClass is accessible via the public static java.lang.Class java.lang.Class.forNamejava.lang.Module,java.lang.String signature...

Design/Logic Flaw

Pebble Templates 3.1.2 allows attackers to bypass a protection mechanism intended to block access to instances of java.lang.Class because getClass is accessible via the public static java.lang.Class java.lang.Class.forNamejava.lang.Module,java.lang.String signature...

Pebble Templates Security Bypass Vulnerability

Pebble Templates is a Java template engine . A security vulnerability exists in Pebble Templates version 3.1.2. The vulnerability can be exploited to bypass the protection mechanism blocking access to java.lang.Class instances with the help of the public static java.lang.Class...

CVE-2019-19899

Pebble Templates 3.1.2 allows attackers to bypass a protection mechanism intended to block access to instances of java.lang.Class because getClass is accessible via the public static java.lang.Class java.lang.Class.forNamejava.lang.Module,java.lang.String signature...

CVE-2019-19899

Pebble Templates 3.1.2 exposes a security bypass: attackers can bypass the protection that blocks access to java.lang.Class via the public static java.lang.Class.forName(java.lang.Module, java.lang.String) signature. Affected component is Pebble Templates (Java template engine) and the root cause...

CVE-2019-19899: Missing Authorization

Pebble Templates 3.1.2 allows attackers to bypass a protection mechanism intended to block access to instances of java.lang.Class because getClass is accessible via the public static java.lang.Class java.lang.Class.forNamejava.lang.Module,java.lang.String signature...

PT-2019-15992

Name of the Vulnerable Software and Affected Versions Pebble Templates versions prior to 3.1.4 Description The issue allows attackers to bypass a protection mechanism intended to block access to instances of java.lang.Class because getClass is accessible via the public static java.lang.Class...

nicepebblessales.com XSS vulnerability

Open Bug Bounty ID: OBB-561274 Description| Value ---|--- Affected Website:| nicepebblessales.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Pebble Smartwatch Device Spoofing Vulnerability

Pebble Smartwatch devices is a smartwatch from the American company Pebble. A security vulnerability exists in Pebble Smartwatch devices version 4.3 and earlier, which stems from the program's failure to properly handle UUID storage. An attacker can read arbitrary application flash memory and...

CVE-2016-10702

Pebble Smartwatch devices through 4.3 mishandle UUID storage, which allows attackers to read an arbitrary application's flash storage, and access an arbitrary application's JavaScript instance, by modifying a UUID value within the header of a crafted application binary...