CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-40532
https://notcve.org/view.php?id=CVE-2021-40532
Telegram Web K Alpha before 0.7.2 mishandles the characters in a document extension. Telegram Web K Alpha versiones anteriores a 0.7.2, maneja inapropiadamente los caracteres de una extensión de documento. • https://github.com/morethanwords/tweb/commit/f224e459c36eb96b2cf9dba559a48b1f08d23330 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-37596
https://notcve.org/view.php?id=CVE-2021-37596
Telegram Web K Alpha 0.6.1 allows XSS via a document name. Telegram Web K Alpha versión 0.6.1, permite un ataque de tipo XSS por medio de un nombre de documento • https://github.com/morethanwords/tweb/commit/11d2fe01363889f20c8baa2217ed4aad445c5551 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 2CVE-2018-20436
https://notcve.org/view.php?id=CVE-2018-20436
The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests for URLs typed while composing a chat message, before that chat message is sent. There are also GET requests to other URLs on the same web server. This also affects one or more other Telegram products, such as Telegram Web-version 0.7.0. In addition, it can be interpreted as an SSRF issue. NOTE: a third party has reported that potentially unwanted behavior is caused by misconfiguration of the "Secret chats > Preview links" setting **EN DISPUTA** La funcionalidad de "chat secreto" en la versión 4.9.1 de Telegram para Android tiene un "canal lateral" a través del cual servidores Telegram envían peticiones GET para URL tipadas mientras redactan un mensaje de chat antes de enviarlo. • https://misteralfa-hack.blogspot.com/2018/12/abusando-de-telegram-para-conseguir-una.html https://misteralfa-hack.blogspot.com/2018/12/telegram-siempre-in-middle.html • CWE-918: Server-Side Request Forgery (SSRF) •