Server-Side Template Injection

pebble is vulnerable to server-side template injection. The fix for an older vulnerability that validates for getClass can be bypassed to inject arbitrary code through the template using the java.lang.Class.forNamejava.lang.Module,java.lang.String signature, resulting in access to java.lang.Runti...

Server-Side Template Injection

pebble is vulnerable to server-side template injection. The allowGetClass validation can be bypassed due to lack case-sensitivity verification. An attacker is able to inject arbitrary code through the template using object.CLASS , object.Class or object.getclass...

CVE-2019-19899

Pebble Templates 3.1.2 allows attackers to bypass a protection mechanism intended to block access to instances of java.lang.Class because getClass is accessible via the public static java.lang.Class java.lang.Class.forNamejava.lang.Module,java.lang.String signature...

CVE-2019-19899

Pebble Templates 3.1.2 allows attackers to bypass a protection mechanism intended to block access to instances of java.lang.Class because getClass is accessible via the public static java.lang.Class java.lang.Class.forNamejava.lang.Module,java.lang.String signature...

Design/Logic Flaw

Pebble Templates 3.1.2 allows attackers to bypass a protection mechanism intended to block access to instances of java.lang.Class because getClass is accessible via the public static java.lang.Class java.lang.Class.forNamejava.lang.Module,java.lang.String signature...

Pebble Templates Security Bypass Vulnerability

Pebble Templates is a Java template engine . A security vulnerability exists in Pebble Templates version 3.1.2. The vulnerability can be exploited to bypass the protection mechanism blocking access to java.lang.Class instances with the help of the public static java.lang.Class...

CVE-2019-19899

Pebble Templates 3.1.2 exposes a security bypass: attackers can bypass the protection that blocks access to java.lang.Class via the public static java.lang.Class.forName(java.lang.Module, java.lang.String) signature. Affected component is Pebble Templates (Java template engine) and the root cause...

nicepebblessales.com XSS vulnerability

Open Bug Bounty ID: OBB-561274 Description| Value ---|--- Affected Website:| nicepebblessales.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Pebble Smartwatch Device Spoofing Vulnerability

Pebble Smartwatch devices is a smartwatch from the American company Pebble. A security vulnerability exists in Pebble Smartwatch devices version 4.3 and earlier, which stems from the program's failure to properly handle UUID storage. An attacker can read arbitrary application flash memory and...

CVE-2016-10702

Pebble Smartwatch devices through 4.3 mishandle UUID storage, which allows attackers to read an arbitrary application's flash storage, and access an arbitrary application's JavaScript instance, by modifying a UUID value within the header of a crafted application binary...

Code injection

Pebble Smartwatch devices through 4.3 mishandle UUID storage, which allows attackers to read an arbitrary application's flash storage, and access an arbitrary application's JavaScript instance, by modifying a UUID value within the header of a crafted application binary...

CVE-2016-10702

Pebble Smartwatch devices through 4.3 mishandle UUID storage, which allows attackers to read an arbitrary application's flash storage, and access an arbitrary application's JavaScript instance, by modifying a UUID value within the header of a crafted application binary...

CVE-2016-10702

Pebble Smartwatch devices (firmware up to 4.3) expose a vulnerability where UUID storage is mishandled, allowing an attacker to modify the header UUID of a crafted application binary. This can enable reading an arbitrary application’s flash storage and accessing the corresponding JavaScript insta...

CVE-2016-10702

Pebble Smartwatch devices through 4.3 mishandle UUID storage, which allows attackers to read an arbitrary application's flash storage, and access an arbitrary application's JavaScript instance, by modifying a UUID value within the header of a crafted application binary...

Pebble - Base64 encoded String, Customized SSL, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Pebble published at the 'play' market has multiple vulnerabilities...

Pebble Nav Me (Trial) - Customized SSL, Insecure KeyStore vulnerabilities

HackApp vulnerability scanner discovered that application Pebble Nav Me Trial published at the 'play' market has multiple vulnerabilities...

Pebble - Customized SSL, Exported ContentProvider, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Pebble published at the 'play' market has multiple vulnerabilities...

Btproxy - Man In The Middle Analysis Tool For Bluetooth

Tested Devices Pebble Steel smart watch Moto 360 smart watch OBDLink OBD-II Bluetooth Dongle Withings Smart Baby Monitor If you have tried anything else, please let me know at conorpp at vt dot edu. Dependencies Need at least 1 Bluetooth card either USB or internal. Need to be running Linux,...

Remote Attack Could Format Your Pebble Smartwatch Easily

Pebble, a wristwatch that can connect to your phone - both iOS and Android - and interact with apps, has a hard-coded vulnerability that allows a remote attacker to destroy your Smartwatch completely. Pebble Smartwatch, developed and released by Pebble Technology Corporation in 2013, is considere...

CVE-2012-4022

Pebble before 2.6.4 allows remote attackers to trigger loss of blog-entry viewability via a crafted comment...