Filtered by vendor Telegram
Subscribe
Total
35 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2017-17715 | 1 Telegram | 1 Telegram Messenger | 2025-04-20 | 6.8 MEDIUM | 8.8 HIGH |
| The saveFile method in MediaController.java in the Telegram Messenger application before 2017-12-08 for Android allows directory traversal via a pathname obtained in a file-transfer request from a remote peer, as demonstrated by writing to tgnet.dat or tgnet.dat.bak. | |||||
| CVE-2014-8688 | 1 Telegram | 1 Messenger | 2025-04-20 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Telegram Messenger 2.6 for iOS and 1.8.2 for Android. Secret chat messages are available in cleartext in process memory and a .db file. | |||||
| CVE-2023-26818 | 1 Telegram | 1 Telegram | 2025-01-21 | N/A | 5.5 MEDIUM |
| Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag. | |||||
| CVE-2023-34658 | 1 Telegram | 1 Telegram | 2024-11-27 | N/A | 5.3 MEDIUM |
| Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController. | |||||
| CVE-2022-43363 | 1 Telegram | 1 Telegram | 2024-11-21 | N/A | 6.1 MEDIUM |
| Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website. NOTE: some third parties have been unable to discern any relationship between the Pastebin information and a possible XSS finding. | |||||
| CVE-2021-41861 | 1 Telegram | 1 Telegram | 2024-11-21 | 2.1 LOW | 3.3 LOW |
| The Telegram application 7.5.0 through 7.8.0 for Android does not properly implement image self-destruction, a different vulnerability than CVE-2019-16248. After approximately two to four uses of the self-destruct feature, there is a misleading UI indication that an image was deleted (on both the sender and recipient sides). The images are still present in the /Storage/Emulated/0/Telegram/Telegram Image/ directory. | |||||
| CVE-2021-40532 | 1 Telegram | 1 Web K Alpha | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| Telegram Web K Alpha before 0.7.2 mishandles the characters in a document extension. | |||||
| CVE-2021-37596 | 1 Telegram | 1 Web K Alpha | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| Telegram Web K Alpha 0.6.1 allows XSS via a document name. | |||||
| CVE-2021-36769 | 1 Telegram | 2 Telegram, Telegram Desktop | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8. An attacker can cause the server to receive messages in a different order than they were sent a client. | |||||
| CVE-2021-31323 | 1 Telegram | 1 Telegram | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
| Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LottieParserImpl::parseDashProperty function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker. | |||||
| CVE-2021-31322 | 1 Telegram | 1 Telegram | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
| Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker. | |||||
| CVE-2021-31321 | 1 Telegram | 1 Telegram | 2024-11-21 | 5.8 MEDIUM | 7.1 HIGH |
| Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the gray_split_cubic function of their custom fork of the rlottie library. A remote attacker might be able to overwrite Telegram's stack memory out-of-bounds on a victim device via a malicious animated sticker. | |||||
| CVE-2021-31320 | 1 Telegram | 1 Telegram | 2024-11-21 | 5.8 MEDIUM | 7.1 HIGH |
| Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the VGradientCache::generateGradientColorTable function of their custom fork of the rlottie library. A remote attacker might be able to overwrite heap memory out-of-bounds on a victim device via a malicious animated sticker. | |||||
| CVE-2021-31319 | 1 Telegram | 1 Telegram | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
| Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by an Integer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker. | |||||
| CVE-2021-31318 | 1 Telegram | 1 Telegram | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
| Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the LOTCompLayerItem::LOTCompLayerItem function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker. | |||||
| CVE-2021-31317 | 1 Telegram | 1 Telegram | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
| Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDasher constructor of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's heap memory out-of-bounds on a victim device via a malicious animated sticker. | |||||
| CVE-2021-31315 | 1 Telegram | 1 Telegram | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
| Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the blit function of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's stack memory out-of-bounds on a victim device via a malicious animated sticker. | |||||
| CVE-2021-30496 | 1 Telegram | 1 Telegram | 2024-11-21 | 3.5 LOW | 5.7 MEDIUM |
| The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the victim pastes an attacker-supplied message (e.g., in the Persian language) into a channel or group. The crash occurs in MtProtoKitFramework. NOTE: the vendor's perspective is that "this behavior can't be considered a vulnerability." | |||||
| CVE-2021-27351 | 1 Telegram | 1 Telegram | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invalidate a recently active session. | |||||
| CVE-2021-27205 | 2 Apple, Telegram | 2 Macos, Telegram | 2024-11-21 | 2.1 LOW | 5.5 MEDIUM |
| Telegram before 7.4 (212543) Stable on macOS stores the local copy of self-destructed messages in a sandbox path, leading to sensitive information disclosure. | |||||