Design/Logic Flaw

The 1 filesystem::getwmllocation function in filesystem.cpp and 2 islegalfile function in filesystemboost.cpp in Battle for Wesnoth before 1.12.3 and 1.13.x before 1.13.1 allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML...

CVE-2015-5070

The CVE-2015-5070 entry concerns Battle for Wesnoth prior to 1.12.4 and 1.13.x before 1.13.1, where the functions filesystem::get_wml_location (filesystem.cpp) and is_legal_file (filesystem_boost.cpp) on case-insensitive filesystems could disclose sensitive information via vectors related to .pbl...

CVE-2015-5069

Removed by vendor...

CVE-2015-5070

Removed by vendor...

CVE-2017-11105

The OnePlus 2 Primary Bootloader PBL does not validate the SBL1 partition before executing it, although it contains a certificate. This allows attackers with write access to that partition to disable signature validation...

CVE-2017-11105

The CVE-2017-11105 vulnerability affects the OnePlus 2 Primary Bootloader (PBL). The PBL does not validate the SBL1 partition before executing it, even though the partition contains a certificate. This allows an attacker with write access to the SBL1 partition to disable signature validation. The...

wesnoth: information leakage

Wesnoth implements a text preprocessing language that is used in conjunction with its own game scripting language. It also has a built-in Lua interpreter and API. Both the Lua API and the preprocessor make use of the same function filesystem::getwmllocation to resolve file paths so that only...

FreeBSD : wesnoth -- disclosure of .pbl files with lowercase, uppercase, and mixed-case extension (2a8b7d21-1ecc-11e5-a4a5-002590263bf5)

Ignacio R. Morelle reports : As mentioned in the Wesnoth 1.12.4 and Wesnoth 1.13.1 release announcements, a security vulnerability targeting add-on authors was found bug 23504 which allowed a malicious user to obtain add-on server passphrases from the client's .pbl files and transmit them over th...

wesnoth -- disclosure of .pbl files with lowercase, uppercase, and mixed-case extension

Ignacio R. Morelle reports: As mentioned in the Wesnoth 1.12.4 and Wesnoth 1.13.1 release announcements, a security vulnerability targeting add-on authors was found bug 23504 which allowed a malicious user to obtain add-on server passphrases from the client's .pbl files and transmit them over the...

Geomi CMS 1.2 & 3.0 - SQL Injection Vulnerability

No description provided by source. + Exploit Title : Geomi CMS by Tridan IT Sql Injection Vunerability Author : ThunDEr HeaD Contact : [email protected] Date : 11-01-2011 HomePage : www.indishell.in Version : 1.2 , 3.0 Tested on : PBL Technology Vulnerability Style : PHPCMS Sql Injection...

PHP-CMS 1.2 / 3.0 SQL Injection

Exploit Title : content Management PHPCMS 3.0 Sql Injection Vunerability Author : ThunDEr HeaD Contact : [email protected] Date : 11-01-2011 HomePage : www.indishell.in Version : 1.2 , 3.0 Tested on : PBL Technology Vulnerability Style : PHPCMS Sql Injection Vunerability...

Geomi CMS 1.23.0 - SQL Injection

Geomi CMS 1.23.0 - SQL Injection + Exploit Title : Geomi CMS by Tridan IT Sql Injection Vunerability Author : ThunDEr HeaD Contact : [email protected] Date : 11-01-2011 HomePage : www.indishell.in Version : 1.2 , 3.0 Tested on : PBL Technology Vulnerability Style : PHPCMS Sql Injection...

Geomi CMS 1.2/3.0 - SQL Injection

Exploit Title : Geomi CMS by Tridan IT Sql Injection Vunerability Author : ThunDEr HeaD Contact : [email protected] Date : 11-01-2011 HomePage : www.indishell.in Version : 1.2 , 3.0 Tested on : PBL Technology Vulnerability Style : PHPCMS Sql Injection Vunerability Vendor:...

CVE-2007-1052

CVE-2007-1052 affects PBLang (PBL) up to version 4.60 (and earlier); a PHP remote file inclusion vulnerability exists in index.php via the dbpath parameter that can allow remote code execution. The description notes this is a different vector than CVE-2006-5062 and includes a dispute context for ...

CVE-2006-5062

CVE-2006-5062 affects PBLang (PBL) with a PHP remote file inclusion vulnerability in templates/pb/language/lang_nl.php via the temppath parameter. Affected are PBLang versions 4.66z and earlier. Exploitation allows remote code execution by supplying a malicious URL. The underlying issue is a PHP ...

CVE-2006-3618

SQL injection vulnerability in pblguestbook.php in Pixelated By Lev PBL Guestbook 1.32 and earlier allows remote attackers to execute arbitrary SQL commands via the 1 name, 2 email, 3 website, 4 comments, 5 rate, and 6 private parameters...

CVE-2006-3617

Cross-site scripting XSS vulnerability in pblguestbook.php in Pixelated By Lev PBL Guestbook 1.32 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 name, 2 message aka comments, 3 website, and 4 email parameters, which bypasses XSS protection mechanisms that che...

CVE-2006-3618

CVE-2006-3618 affects Pixelated By Lev (PBL) Guestbook, versions 1.32 and earlier, via SQL injection in pblguestbook.php. The vulnerability allows remote attackers to execute arbitrary SQL commands through the (1) name, (2) email, (3) website, (4) comments, (5) rate, and (6) private parameters. T...

CVE-2006-3618

SQL injection vulnerability in pblguestbook.php in Pixelated By Lev PBL Guestbook 1.32 and earlier allows remote attackers to execute arbitrary SQL commands via the 1 name, 2 email, 3 website, 4 comments, 5 rate, and 6 private parameters...

CVE-2006-3617

The CVE-2006-3617 entry describes a Cross-site scripting (XSS) vulnerability in Pixelated By Lev (PBL) Guestbook, specifically pblguestbook.php, affecting PBL Guestbook 1.32 and earlier. The vulnerability allows remote attackers to inject arbitrary script or HTML via the name, message, website, a...