In Telegram WebK before 2.0.0 (488), a crafted Mini Web App allows XSS via the postMessage web_app_open_link event type.
Source: MITRE
Max CVSS
N/A
EPSS Score
0.05%
Published
2024-04-29
Updated
2024-05-01
Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController.
Source: MITRE
Max CVSS
5.3
EPSS Score
0.05%
Published
2023-06-29
Updated
2023-07-07
Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag.
Source: MITRE
Max CVSS
5.5
EPSS Score
0.04%
Published
2023-05-19
Updated
2023-05-26
Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website. NOTE: some third parties have been unable to discern any relationship between the Pastebin information and a possible XSS finding.
Source: MITRE
Max CVSS
6.1
EPSS Score
0.08%
Published
2022-12-06
Updated
2024-05-17
The Telegram application 7.5.0 through 7.8.0 for Android does not properly implement image self-destruction, a different vulnerability than CVE-2019-16248. After approximately two to four uses of the self-destruct feature, there is a misleading UI indication that an image was deleted (on both the sender and recipient sides). The images are still present in the /Storage/Emulated/0/Telegram/Telegram Image/ directory.
Source: MITRE
Max CVSS
3.3
EPSS Score
0.05%
Published
2021-10-04
Updated
2021-10-08
Telegram Web K Alpha before 0.7.2 mishandles the characters in a document extension.
Source: MITRE
Max CVSS
9.8
EPSS Score
0.22%
Published
2021-09-06
Updated
2021-09-10
Telegram Web K Alpha 0.6.1 allows XSS via a document name.
Source: MITRE
Max CVSS
6.1
EPSS Score
0.08%
Published
2021-07-30
Updated
2021-08-09
A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8. An attacker can cause the server to receive messages in a different order than they were sent a client.
Source: MITRE
Max CVSS
5.3
EPSS Score
0.08%
Published
2021-07-17
Updated
2021-07-29
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LottieParserImpl::parseDashProperty function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
Source: MITRE
Max CVSS
5.5
EPSS Score
0.13%
Published
2021-05-18
Updated
2021-05-25
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
Source: MITRE
Max CVSS
5.5
EPSS Score
0.13%
Published
2021-05-18
Updated
2021-05-25
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the gray_split_cubic function of their custom fork of the rlottie library. A remote attacker might be able to overwrite Telegram's stack memory out-of-bounds on a victim device via a malicious animated sticker.
Source: MITRE
Max CVSS
7.1
EPSS Score
0.14%
Published
2021-05-18
Updated
2021-05-25
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the VGradientCache::generateGradientColorTable function of their custom fork of the rlottie library. A remote attacker might be able to overwrite heap memory out-of-bounds on a victim device via a malicious animated sticker.
Source: MITRE
Max CVSS
7.1
EPSS Score
0.13%
Published
2021-05-18
Updated
2021-05-25
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by an Integer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
Source: MITRE
Max CVSS
5.5
EPSS Score
0.17%
Published
2021-05-18
Updated
2021-05-25
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the LOTCompLayerItem::LOTCompLayerItem function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
Source: MITRE
Max CVSS
5.5
EPSS Score
0.14%
Published
2021-05-18
Updated
2021-05-25
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDasher constructor of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's heap memory out-of-bounds on a victim device via a malicious animated sticker.
Source: MITRE
Max CVSS
5.5
EPSS Score
0.14%
Published
2021-05-18
Updated
2021-05-25
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the blit function of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's stack memory out-of-bounds on a victim device via a malicious animated sticker.
Source: MITRE
Max CVSS
5.5
EPSS Score
0.14%
Published
2021-05-18
Updated
2021-05-25
The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the victim pastes an attacker-supplied message (e.g., in the Persian language) into a channel or group. The crash occurs in MtProtoKitFramework. NOTE: the vendor's perspective is that "this behavior can't be considered a vulnerability."
Source: MITRE
Max CVSS
5.7
EPSS Score
0.12%
Published
2021-04-20
Updated
2024-05-17
The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invalidate a recently active session.
Source: MITRE
Max CVSS
5.3
EPSS Score
0.07%
Published
2021-02-19
Updated
2022-05-23
Telegram before 7.4 (212543) Stable on macOS stores the local copy of self-destructed messages in a sandbox path, leading to sensitive information disclosure.
Source: MITRE
Max CVSS
5.5
EPSS Score
0.05%
Published
2021-02-12
Updated
2021-09-08
Telegram before 7.4 (212543) Stable on macOS stores the local passcode in cleartext, leading to information disclosure.
Source: MITRE
Max CVSS
5.5
EPSS Score
0.05%
Published
2021-02-12
Updated
2021-09-08
Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard. The threat model is a victim who has voluntarily opened Export Wizard but is then distracted. An attacker then approaches the unattended desktop and pushes the Export key. This attacker may consequently gain access to all chat conversation and media files.
Source: MITRE
Max CVSS
2.4
EPSS Score
0.07%
Published
2020-10-14
Updated
2021-07-21
Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrated by use of the chat window with a filename that lacks an extension.
Source: MITRE
Max CVSS
7.8
EPSS Score
0.20%
Published
2020-08-11
Updated
2021-01-28
Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homograph attack via Punycode in a public URL or a group chat invitation URL.
Source: MITRE
Max CVSS
6.5
EPSS Score
0.16%
Published
2020-05-01
Updated
2021-07-21
The Telegram application through 5.12 for Android, when Show Popup is enabled, might allow physically proximate attackers to bypass intended restrictions on message reading and message replying. This might be interpreted as a bypass of the passcode feature.
Source: MITRE
Max CVSS
6.1
EPSS Score
0.07%
Published
2020-03-24
Updated
2021-07-21
The "delete for" feature in Telegram before 5.11 on Android does not delete shared media files from the Telegram Images directory. In other words, there is a potentially misleading UI indication that a sender can remove a recipient's copy of a previously sent image (analogous to supported functionality in which a sender can remove a recipient's copy of a previously sent message).
Source: MITRE
Max CVSS
5.5
EPSS Score
0.07%
Published
2019-09-11
Updated
2021-10-18
36 vulnerabilities found
1 2
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!