CVE-2023-24068

Signal Desktop prior to 6.2.0 on Windows, Linux, and macOS is affected by a vulnerability where attachments stored in the attachments.noindex directory can be modified by an attacker. The flaw arises from insufficient validation of modifications to cached files, enabling an attacker to insert mal...

CVE-2023-24068: Undefined Security Weakness

Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify conversation attachments within the attachments.noindex directory. Client mechanisms fail to validate modifications of existing cached files, resulting in an attacker's ability to insert malicious code into...

Signal Desktop 安全漏洞

Signal Desktop is a desktop version of a live chat application with encryption. A security vulnerability exists in Signal Desktop versions prior to 6.2.0. An attacker can exploit the vulnerability to obtain sensitive attachments in the attachments.noindex directory...

Signal Desktop 安全漏洞

Signal Desktop is a desktop version of a live chat application with encryption. A security vulnerability exists in Signal Desktop versions prior to 6.2.0. An attacker can exploit the vulnerability to obtain session attachments in the attachments.noindex directory...

CVE-2023-24069

Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments sent in messages from the attachments.noindex directory. Cached attachments are not effectively cleared. In some cases, even after a self-initiated file deletion, an attacker ca...

CVE-2023-24068

Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify conversation attachments within the attachments.noindex directory. Client mechanisms fail to validate modifications of existing cached files, resulting in an attacker's ability to insert malicious code into...

CVE-2023-24069: Exposure of Sensitive Information to an Unauthorized Actor

Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments sent in messages from the attachments.noindex directory. Cached attachments are not effectively cleared. In some cases, even after a self-initiated file deletion, an attacker ca...

CVE-2019-19954

Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\nodemodules.bin\wmic.exe file...

CVE-2019-19954

Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\nodemodules.bin\wmic.exe file...

Design/Logic Flaw

Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\nodemodules.bin\wmic.exe file...

CVE-2019-19954

Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\nodemodules.bin\wmic.exe file...

CVE-2019-19954

Signal Desktop (Windows) prior to 1.29.1 contains a local privilege escalation flaw: an attacker can place a Trojan horse named wmic.exe under %SYSTEMDRIVE%\node_modules.bin to gain higher privileges. Descriptions across NVD, Red Hat, OSV, ENISA-related entries corroborate the same issue. No func...

Unspecified Vulnerability in Signal Desktop

Signal Desktop is a live chat application with encryption for desktop. An unspecified vulnerability exists in Signal Desktop. An attacker can exploit this vulnerability by creating a malicious %SYSTEMDRIVE% odemodules.binwmic.exe file to gain privileges...

CVE-2019-9970

Open Whisper Signal (Signal-Desktop) up to version 1.23.1 and Signal Private Messenger for Android up to 4.35.3 are vulnerable to an IDN homograph attack when displaying messages that contain URLs. The root cause is that the app renders a clickable link even when the domain contains mixed Latin/C...

CVE-2019-9970

Open Whisper Signal aka Signal-Desktop through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if for example Latin...

Open Whisper Signal Information Disclosure Vulnerability

Open Whisper Signal aka Signal-Desktop is a live chat application with encryption. An information disclosure vulnerability exists in versions prior to Open Whisper Signal 1.15.0-beta.10. An attacker can exploit the vulnerability to recover expired messages...

Open redirect

Open Whisper Signal aka Signal-Desktop before 1.15.0-beta.10 allows information leakage...

CVE-2018-14023

Open Whisper Signal aka Signal-Desktop before 1.15.0-beta.10 allows information leakage...

CVE-2018-14023

CVE-2018-14023 affects Open Whisper Signal (Signal-Desktop). Multiple sources describe an information-disclosure vulnerability that exists in versions prior to 1.15.0-beta.10, allowing an attacker to recover expired messages. The CNVD entry explicitly states “Open Whisper Signal Information Discl...

Open Whisper Signal Cross-Site Scripting Vulnerability

Open Whisper Signal aka Signal-Desktop is a live chat application with encryption. A cross-site scripting vulnerability exists in Open Whisper Signal 1.10.1 and earlier versions, which stems from the program failing to filter HTML elements. A remote attacker can exploit the vulnerability by sendi...