Telegram : Security Vulnerabilities, CVEs, Published In 2020
Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrated by use of the chat window with a filename that lacks an extension.
Max CVSS
7.8
EPSS Score
0.20%
Published
2020-08-11
Updated
2021-01-28
Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homograph attack via Punycode in a public URL or a group chat invitation URL.
Max CVSS
6.5
EPSS Score
0.16%
Published
2020-05-01
Updated
2021-07-21
The Telegram application through 5.12 for Android, when Show Popup is enabled, might allow physically proximate attackers to bypass intended restrictions on message reading and message replying. This might be interpreted as a bypass of the passcode feature.
Max CVSS
6.1
EPSS Score
0.07%
Published
2020-03-24
Updated
2021-07-21
Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard. The threat model is a victim who has voluntarily opened Export Wizard but is then distracted. An attacker then approaches the unattended desktop and pushes the Export key. This attacker may consequently gain access to all chat conversation and media files.
Max CVSS
2.4
EPSS Score
0.07%
Published
2020-10-14
Updated
2021-07-21
4 vulnerabilities found