Filtered by vendor Telegram
Subscribe
Search
Total
20 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-36769 | 1 Telegram | 2 Telegram, Telegram Desktop | 2023-08-08 | 5.0 MEDIUM | 5.3 MEDIUM |
| A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8. An attacker can cause the server to receive messages in a different order than they were sent a client. | |||||
| CVE-2021-27351 | 1 Telegram | 1 Telegram | 2022-05-23 | 5.0 MEDIUM | 5.3 MEDIUM |
| The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invalidate a recently active session. | |||||
| CVE-2019-16248 | 1 Telegram | 1 Telegram | 2021-10-18 | 2.1 LOW | 5.5 MEDIUM |
| The "delete for" feature in Telegram before 5.11 on Android does not delete shared media files from the Telegram Images directory. In other words, there is a potentially misleading UI indication that a sender can remove a recipient's copy of a previously sent image (analogous to supported functionality in which a sender can remove a recipient's copy of a previously sent message). | |||||
| CVE-2021-27205 | 2 Apple, Telegram | 2 Macos, Telegram | 2021-09-08 | 2.1 LOW | 5.5 MEDIUM |
| Telegram before 7.4 (212543) Stable on macOS stores the local copy of self-destructed messages in a sandbox path, leading to sensitive information disclosure. | |||||
| CVE-2021-27204 | 2 Apple, Telegram | 2 Macos, Telegram | 2021-09-08 | 2.1 LOW | 5.5 MEDIUM |
| Telegram before 7.4 (212543) Stable on macOS stores the local passcode in cleartext, leading to information disclosure. | |||||
| CVE-2021-37596 | 1 Telegram | 1 Web K Alpha | 2021-08-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| Telegram Web K Alpha 0.6.1 allows XSS via a document name. | |||||
| CVE-2020-12474 | 1 Telegram | 2 Telegram, Telegram Desktop | 2021-07-21 | 4.3 MEDIUM | 6.5 MEDIUM |
| Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homograph attack via Punycode in a public URL or a group chat invitation URL. | |||||
| CVE-2020-10570 | 1 Telegram | 1 Telegram | 2021-07-21 | 3.6 LOW | 6.1 MEDIUM |
| The Telegram application through 5.12 for Android, when Show Popup is enabled, might allow physically proximate attackers to bypass intended restrictions on message reading and message replying. This might be interpreted as a bypass of the passcode feature. | |||||
| CVE-2019-15514 | 1 Telegram | 1 Telegram | 2021-07-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is Nobody, because attackers can find these numbers via the Group Info feature, e.g., by adding a significant fraction of a region's assigned phone numbers. | |||||
| CVE-2021-31323 | 1 Telegram | 1 Telegram | 2021-05-25 | 4.3 MEDIUM | 5.5 MEDIUM |
| Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LottieParserImpl::parseDashProperty function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker. | |||||
| CVE-2021-31322 | 1 Telegram | 1 Telegram | 2021-05-25 | 4.3 MEDIUM | 5.5 MEDIUM |
| Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker. | |||||
| CVE-2021-31319 | 1 Telegram | 1 Telegram | 2021-05-25 | 4.3 MEDIUM | 5.5 MEDIUM |
| Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by an Integer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker. | |||||
| CVE-2021-31318 | 1 Telegram | 1 Telegram | 2021-05-25 | 4.3 MEDIUM | 5.5 MEDIUM |
| Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the LOTCompLayerItem::LOTCompLayerItem function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker. | |||||
| CVE-2021-31317 | 1 Telegram | 1 Telegram | 2021-05-25 | 4.3 MEDIUM | 5.5 MEDIUM |
| Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDasher constructor of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's heap memory out-of-bounds on a victim device via a malicious animated sticker. | |||||
| CVE-2021-31315 | 1 Telegram | 1 Telegram | 2021-05-25 | 4.3 MEDIUM | 5.5 MEDIUM |
| Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the blit function of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's stack memory out-of-bounds on a victim device via a malicious animated sticker. | |||||
| CVE-2021-30496 | 1 Telegram | 1 Telegram | 2021-04-24 | 3.5 LOW | 5.7 MEDIUM |
| The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the victim pastes an attacker-supplied message (e.g., in the Persian language) into a channel or group. The crash occurs in MtProtoKitFramework. | |||||
| CVE-2018-3986 | 1 Telegram | 1 Telegram | 2019-02-04 | 2.1 LOW | 5.5 MEDIUM |
| An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android messaging application version 4.9.0. The "Secret Chats" functionality allows a user to delete all traces of a chat, either by using a time trigger or by direct request. There is a bug in this functionality that leaves behind photos taken and shared on the secret chats, even after the chats are deleted. These photos will be stored in the device and accessible to all applications installed on the Android device. | |||||
| CVE-2018-17780 | 1 Telegram | 2 Telegram Desktop, Telegram Messenger | 2018-12-06 | 4.0 MEDIUM | 6.5 MEDIUM |
| Telegram Desktop (aka tdesktop) 1.3.14, and Telegram 3.3.0.0 WP8.1 on Windows, leaks end-user public and private IP addresses during a call because of an unsafe default behavior in which P2P connections are accepted from clients outside of the My Contacts list. | |||||
| CVE-2018-15542 | 1 Telegram | 1 Telegram | 2018-11-26 | 4.4 MEDIUM | 6.4 MEDIUM |
| ** DISPUTED ** An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's return value to true. In other words, an attacker could authenticate with an arbitrary passcode. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred. | |||||
| CVE-2018-15543 | 1 Telegram | 1 Telegram | 2018-11-24 | 4.6 MEDIUM | 6.8 MEDIUM |
| ** DISPUTED ** An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The FingerprintManager class for Biometric validation allows authentication bypass through the callback method from onAuthenticationFailed to onAuthenticationSucceeded with null, because the fingerprint API in conjunction with the Android keyGenerator class is not implemented. In other words, an attacker could authenticate with an arbitrary fingerprint. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred. | |||||