CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 1CVE-2021-27205
https://notcve.org/view.php?id=CVE-2021-27205
12 Feb 2021 — Telegram before 7.4 (212543) Stable on macOS stores the local copy of self-destructed messages in a sandbox path, leading to sensitive information disclosure. Telegram versiones anteriores a 7.4 (212543) Stable en macOS almacena la copia local de mensajes autodestruidos en una ruta de espacio aislado, conllevando a una divulgación de información confidencial • https://www.inputzero.io/2020/12/telegram-privacy-fails-again.html • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 2.4EPSS: 0%CPEs: 1EXPL: 0CVE-2020-25824 – Gentoo Linux Security Advisory 202101-34
https://notcve.org/view.php?id=CVE-2020-25824
14 Oct 2020 — Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard. The threat model is a victim who has voluntarily opened Export Wizard but is then distracted. An attacker then approaches the unattended desktop and pushes the Export key. This attacker may consequently gain access to all chat conversation and media files. Telegram Desktop versiones hasta 2.4.3, no requiere el ingreso de un código de acceso al presionar la tecla Exportar dentro ... • https://github.com/soheilsamanabadi/vulnerability/blob/main/Telegram-Desktop-CVE-2020-25824 • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-17448 – Gentoo Linux Security Advisory 202101-34
https://notcve.org/view.php?id=CVE-2020-17448
11 Aug 2020 — Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrated by use of the chat window with a filename that lacks an extension. Telegram Desktop versiones hasta 2.1.13, permite a un tipo de archivo falsificado omitir el mecanismo de protección Dangerous File Type Execution, como es demostrado al usar la ventana de chat con un nombre de archivo que carece de una extensión Multiple vulnerabilities have been found in Telegram, the ... • https://github.com/VijayT007/Vulnerability-Database/blob/master/Telegram-CVE-2020-17448 • CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-12474
https://notcve.org/view.php?id=CVE-2020-12474
01 May 2020 — Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homograph attack via Punycode in a public URL or a group chat invitation URL. Telegram Desktop versiones hasta 2.0.1, Telegram versiones hasta 6.0.1 para Android y Telegram versiones hasta 6.0.1 para iOS, permiten un ataque de Homógrafo IDN por medio de un Punycode en una URL pública o una URL de invitación de chat grupal. • https://github.com/VijayT007/Vulnerability-Database/blob/master/Telegram:CVE-2020-12474 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-10570
https://notcve.org/view.php?id=CVE-2020-10570
24 Mar 2020 — The Telegram application through 5.12 for Android, when Show Popup is enabled, might allow physically proximate attackers to bypass intended restrictions on message reading and message replying. This might be interpreted as a bypass of the passcode feature. La aplicación Telegram versiones hasta 5.12 para Android, cuando Show Popup está habilitado, podría permitir a atacantes físicamente próximos omitir restricciones previstas en la lectura y respuesta de mensajes. Esto podría interpretarse como una omisión... • https://github.com/VijayT007/Vulnerability-Database/blob/master/Telegram:CVE-2020-10570 •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-16248
https://notcve.org/view.php?id=CVE-2019-16248
11 Sep 2019 — The "delete for" feature in Telegram before 5.11 on Android does not delete shared media files from the Telegram Images directory. In other words, there is a potentially misleading UI indication that a sender can remove a recipient's copy of a previously sent image (analogous to supported functionality in which a sender can remove a recipient's copy of a previously sent message). La funcionalidad "delete for" en Telegram versiones anteriores a 5.11 en Android no elimina los archivos multimedia compartidos d... • https://github.com/RootUp/PersonalStuff/blob/master/Telegram_Privacy.pdf •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 2CVE-2019-15514
https://notcve.org/view.php?id=CVE-2019-15514
23 Aug 2019 — The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is Nobody, because attackers can find these numbers via the Group Info feature, e.g., by adding a significant fraction of a region's assigned phone numbers. openITCOCKPIT anterior de la versión 3.7.1 permite la inyección de código, La función Privacidad> Número de teléfono en la aplicación Telegram 5.10 para Android e iOS proporciona una indicación incorrecta de que el nivel... • https://github.com/bibi1959/CVE-2019-15514 •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 1CVE-2019-10044
https://notcve.org/view.php?id=CVE-2019-10044
25 Mar 2019 — Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters exist in the same domain name, and the available font has an identical representation of characters from different alphabets. Telegram Desktop, en versiones anteriores a la 1.5.12 en Windows, y las aplicaciones de... • http://www.securityfocus.com/bid/107610 •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-3986
https://notcve.org/view.php?id=CVE-2018-3986
03 Jan 2019 — An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android messaging application version 4.9.0. The "Secret Chats" functionality allows a user to delete all traces of a chat, either by using a time trigger or by direct request. There is a bug in this functionality that leaves behind photos taken and shared on the secret chats, even after the chats are deleted. These photos will be stored in the device and accessible to all applications installed on... • http://www.securityfocus.com/bid/106295 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.1EPSS: 1%CPEs: 2EXPL: 2CVE-2018-20436
https://notcve.org/view.php?id=CVE-2018-20436
24 Dec 2018 — The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests for URLs typed while composing a chat message, before that chat message is sent. There are also GET requests to other URLs on the same web server. This also affects one or more other Telegram products, such as Telegram Web-version 0.7.0. In addition, it can be interpreted as an SSRF issue. NOTE: a third party has reported that potentially unwanted behavior is caused by misconfiguration of... • https://misteralfa-hack.blogspot.com/2018/12/abusando-de-telegram-para-conseguir-una.html • CWE-918: Server-Side Request Forgery (SSRF) •