Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
signal signal vulnerabilities and exploits
(subscribe to this query)
2.1
CVSSv2
CVE-2018-14023
Open Whisper Signal (aka Signal-Desktop) prior to 1.15.0-beta.10 allows information leakage.
Signal Signal-desktop 1.15.0
Signal Signal-desktop
5
CVSSv2
CVE-2020-5753
Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disclose currently used DNS server due to ICE Candidate handling before call is answered or declined.
Signal Signal
Signal Private Messenger
4.3
CVSSv2
CVE-2019-9970
Open Whisper Signal (aka Signal-Desktop) up to and including 1.23.1 and the Signal Private Messenger application up to and including 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces...
Signal Signal-desktop
Signal Private Messenger
4.6
CVSSv2
CVE-2018-9840
The Open Whisper Signal app prior to 2.23.2 for iOS allows physically proximate malicious users to bypass the screen locker feature via certain rapid sequences of actions that include app opening, clicking on cancel, and using the home button.
Signal Signal
5
CVSSv2
CVE-2022-28345
The Signal app prior to 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders RTLO encoded URLs beginning with a non-breaking space, when there is a hash character in the URL. This technique allows a remote unauthenticated malicious user to send legitimate l...
Signal Signal
7.8
CVSSv2
CVE-2018-16132
The image rendering component (createGenericPreview) of the Open Whisper Signal app up to and including 2.29.0 for iOS fails to check for unreasonably large images before manipulating received images. This allows for a large image sent to a user to exhaust all available memory wh...
Signal Signal
NA
CVE-2023-24069
Signal Desktop prior to 6.2.0 on Windows, Linux, and macOS allows an malicious user to obtain potentially sensitive attachments sent in messages from the attachments.noindex directory. Cached attachments are not effectively cleared. In some cases, even after a self-initiated file...
Signal Signal-desktop
4.3
CVSSv2
CVE-2018-11101
Open Whisper Signal (aka Signal-Desktop) up to and including 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994. The attacker needs t...
Signal Signal-desktop
1 Article
4.3
CVSSv2
CVE-2018-10994
js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) prior to 1.10.1 allows XSS via a URL.
Signal Signal-desktop
1 Article
NA
CVE-2023-24068
Signal Desktop prior to 6.2.0 on Windows, Linux, and macOS allows an malicious user to modify conversation attachments within the attachments.noindex directory. Client mechanisms fail to validate modifications of existing cached files, resulting in an attacker's ability to i...
Signal Signal-desktop
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
camera
bypass
CVE-2024-3592
CVE-2024-37383
CVE-2024-24919
CVE-2024-27822
CVE-2024-36788
CVE-2024-36789
man-in-the-middle
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
4
5
NEXT »