Signal Desktop 安全漏洞

Signal Desktop is a desktop version of a live chat application with encryption. A security vulnerability exists in Signal Desktop versions prior to 6.2.0. An attacker can exploit the vulnerability to obtain session attachments in the attachments.noindex directory...

Signal Desktop 安全漏洞

Signal Desktop is a desktop version of a live chat application with encryption. A security vulnerability exists in Signal Desktop versions prior to 6.2.0. An attacker can exploit the vulnerability to obtain sensitive attachments in the attachments.noindex directory...

CVE-2019-19954

Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\nodemodules.bin\wmic.exe file...

CVE-2019-19954

Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\nodemodules.bin\wmic.exe file...

Design/Logic Flaw

Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\nodemodules.bin\wmic.exe file...

CVE-2019-19954

Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\nodemodules.bin\wmic.exe file...

CVE-2019-19954

Signal Desktop (Windows) prior to 1.29.1 contains a local privilege escalation flaw: an attacker can place a Trojan horse named wmic.exe under %SYSTEMDRIVE%\node_modules.bin to gain higher privileges. Descriptions across NVD, Red Hat, OSV, ENISA-related entries corroborate the same issue. No func...

Unspecified Vulnerability in Signal Desktop

Signal Desktop is a live chat application with encryption for desktop. An unspecified vulnerability exists in Signal Desktop. An attacker can exploit this vulnerability by creating a malicious %SYSTEMDRIVE% odemodules.binwmic.exe file to gain privileges...

CVE-2019-9970

Open Whisper Signal (Signal-Desktop) up to version 1.23.1 and Signal Private Messenger for Android up to 4.35.3 are vulnerable to an IDN homograph attack when displaying messages that contain URLs. The root cause is that the app renders a clickable link even when the domain contains mixed Latin/C...

CVE-2019-9970

Open Whisper Signal aka Signal-Desktop through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if for example Latin...

Open Whisper Signal Information Disclosure Vulnerability

Open Whisper Signal aka Signal-Desktop is a live chat application with encryption. An information disclosure vulnerability exists in versions prior to Open Whisper Signal 1.15.0-beta.10. An attacker can exploit the vulnerability to recover expired messages...

CVE-2018-14023

Open Whisper Signal aka Signal-Desktop before 1.15.0-beta.10 allows information leakage...

Open redirect

Open Whisper Signal aka Signal-Desktop before 1.15.0-beta.10 allows information leakage...

CVE-2018-14023

CVE-2018-14023 affects Open Whisper Signal (Signal-Desktop). Multiple sources describe an information-disclosure vulnerability that exists in versions prior to 1.15.0-beta.10, allowing an attacker to recover expired messages. The CNVD entry explicitly states “Open Whisper Signal Information Discl...

Open Whisper Signal Cross-Site Scripting Vulnerability

Open Whisper Signal aka Signal-Desktop is a live chat application with encryption. A cross-site scripting vulnerability exists in Open Whisper Signal 1.10.1 and earlier versions, which stems from the program failing to filter HTML elements. A remote attacker can exploit the vulnerability by sendi...

CVE-2018-11101

Open Whisper Signal aka Signal-Desktop through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994. The attacker needs to send HTML code directly as a...

CVE-2018-11101

Open Whisper Signal aka Signal-Desktop through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994. The attacker needs to send HTML code directly as a...

CVE-2018-11101

CVE-2018-11101 affects Signal Desktop (Open Whisper Signal) up to version 1.10.1. The vulnerability arises from incorrect handling of HTML when rendering quoted-reply messages, allowing XSS via HTML injected in a message that is later quoted/replied to. The root cause involved React dangerouslySe...

CVE-2018-11101

Open Whisper Signal aka Signal-Desktop through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994. The attacker needs to send HTML code directly as a...

Another severe flaw in Signal desktop app lets hackers steal your chats in plaintext

For the second time in less than a week, users of the popular end-to-end encrypted Signal messaging app have to update their desktop applications once again to patch another severe code injection vulnerability. Discovered Monday by the same team of security researchers, the newly discovered...