Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website. NOTE: some third parties have been unable to discern any relationship between the Pastebin information and a possible XSS finding.
Max CVSS
6.1
EPSS Score
0.08%
Published
2022-12-06
Updated
2024-04-11
Telegram Web K Alpha before 0.7.2 mishandles the characters in a document extension.
Max CVSS
9.8
EPSS Score
0.20%
Published
2021-09-06
Updated
2021-09-10
Telegram Web K Alpha 0.6.1 allows XSS via a document name.
Max CVSS
6.1
EPSS Score
0.08%
Published
2021-07-30
Updated
2021-08-09
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the gray_split_cubic function of their custom fork of the rlottie library. A remote attacker might be able to overwrite Telegram's stack memory out-of-bounds on a victim device via a malicious animated sticker.
Max CVSS
7.1
EPSS Score
0.14%
Published
2021-05-18
Updated
2021-05-25
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the VGradientCache::generateGradientColorTable function of their custom fork of the rlottie library. A remote attacker might be able to overwrite heap memory out-of-bounds on a victim device via a malicious animated sticker.
Max CVSS
7.1
EPSS Score
0.13%
Published
2021-05-18
Updated
2021-05-25
Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrated by use of the chat window with a filename that lacks an extension.
Max CVSS
7.8
EPSS Score
0.20%
Published
2020-08-11
Updated
2021-01-28
Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homograph attack via Punycode in a public URL or a group chat invitation URL.
Max CVSS
6.5
EPSS Score
0.16%
Published
2020-05-01
Updated
2021-07-21
The Telegram application through 5.12 for Android, when Show Popup is enabled, might allow physically proximate attackers to bypass intended restrictions on message reading and message replying. This might be interpreted as a bypass of the passcode feature.
Max CVSS
6.1
EPSS Score
0.07%
Published
2020-03-24
Updated
2021-07-21
Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters exist in the same domain name, and the available font has an identical representation of characters from different alphabets.
Max CVSS
8.8
EPSS Score
0.52%
Published
2019-03-25
Updated
2021-07-21
The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests for URLs typed while composing a chat message, before that chat message is sent. There are also GET requests to other URLs on the same web server. This also affects one or more other Telegram products, such as Telegram Web-version 0.7.0. In addition, it can be interpreted as an SSRF issue. NOTE: a third party has reported that potentially unwanted behavior is caused by misconfiguration of the "Secret chats > Preview links" setting
Max CVSS
8.1
EPSS Score
0.98%
Published
2018-12-24
Updated
2024-04-11
Telegram Desktop (aka tdesktop) 1.3.14, and Telegram 3.3.0.0 WP8.1 on Windows, leaks end-user public and private IP addresses during a call because of an unsafe default behavior in which P2P connections are accepted from clients outside of the My Contacts list.
Max CVSS
6.5
EPSS Score
0.10%
Published
2018-09-29
Updated
2018-12-06
Telegram Desktop (aka tdesktop) 1.3.16 alpha, when "Use proxy" is enabled, sends credentials and application data in cleartext over the SOCKS5 protocol.
Max CVSS
9.8
EPSS Score
0.22%
Published
2018-09-28
Updated
2019-10-03
Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and application exit) via an "Edit color palette" search that triggers an "index out of range" condition. NOTE: this issue is disputed by multiple third parties because the described attack scenario does not cross a privilege boundary
Max CVSS
7.5
EPSS Score
0.08%
Published
2018-09-19
Updated
2024-04-11
An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The FingerprintManager class for Biometric validation allows authentication bypass through the callback method from onAuthenticationFailed to onAuthenticationSucceeded with null, because the fingerprint API in conjunction with the Android keyGenerator class is not implemented. In other words, an attacker could authenticate with an arbitrary fingerprint. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred
Max CVSS
6.8
EPSS Score
0.07%
Published
2018-10-09
Updated
2024-04-11
An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's return value to true. In other words, an attacker could authenticate with an arbitrary passcode. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred
Max CVSS
6.4
EPSS Score
0.07%
Published
2018-10-09
Updated
2024-04-11
The saveFile method in MediaController.java in the Telegram Messenger application before 2017-12-08 for Android allows directory traversal via a pathname obtained in a file-transfer request from a remote peer, as demonstrated by writing to tgnet.dat or tgnet.dat.bak.
Max CVSS
8.8
EPSS Score
0.15%
Published
2017-12-16
Updated
2018-01-04
An issue was discovered in Telegram Messenger 2.6 for iOS and 1.8.2 for Android. Secret chat messages are available in cleartext in process memory and a .db file.
Max CVSS
7.5
EPSS Score
0.17%
Published
2017-03-14
Updated
2020-05-13
17 vulnerabilities found
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!