CVE-2025-48930

The TeleMessage service through 2025-05-05 stores certain cleartext information in memory, even though memory content may be accessible to an adversary through various avenues...

CVE-2025-48926

The admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail addresses, passwords, and telephone numbers...

CVE-2025-48931

The TeleMessage service through 2025-05-05 relies on MD5 for password hashing, which opens up various attack possibilities including rainbow tables with low computational effort...

CVE-2025-48929

The TeleMessage service (version 2025-05-05 and earlier) is vulnerable to credential reuse because it implements authentication using long-lived credentials instead of short-lived tokens. An adversary who discovers these credentials can reuse them at a later date to gain unauthorized access. This...

CVE-2025-48930

The TeleMessage service (version 2025-05-05 and earlier) contains a vulnerability where certain cleartext information is stored in memory. Because memory content may be accessible to an adversary through various avenues, this flaw could lead to message disclosure . Real-world exploitation of this...

CVE-2025-48931

The CVE-2025-48931 entry concerns TeleMessage service passwords hashed with MD5 (through 2025-05-05). Root cause: MD5-based password hashing enabling rainbow-table and related attacks with low computational effort. Impact is implied as password-cryptography weakness; no explicit exploited vector ...

CVE-2025-48926

The TeleMessage service (versions through 2025-05-05 ) contains a security vulnerability in its admin panel that allows attackers to discover sensitive information, including usernames , e-mail addresses , passwords , and telephone numbers . This vulnerability has been exploited in the wild . As ...

CVE-2025-48928

CVE-2025-48928 affects the TeleMessage service (TeleMessage TM SGNL) running a JSP-based application up to 2025-05-05. The issue is that heap content can resemble a core dump, exposing passwords previously sent over HTTP within that dump. Exploitation was observed in the wild in May 2025. Public ...

CVE-2025-48927

CVE-2025-48927 concerns TeleMessage service configuring Spring Boot Actuator with an exposed /heapdump endpoint. Connected sources confirm the heapdump exposure stems from Actuator configuration and is implicated by multiple advisories (NVD entry, CISA KEV listing, and related GitHub/GHSA advisor...

CVE-2025-48925

The TeleMessage service (version 2025-05-05 and earlier) is vulnerable because it relies on the client side (e.g., the TM SGNL app ) to perform MD5 hashing and then accepts that hash as a valid authentication credential. This architectural flaw allows for potential authentication bypass or creden...

CVE-2025-48928

The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025...

CVE-2025-48925

The TeleMessage service through 2025-05-05 relies on the client side e.g., the TM SGNL app to do MD5 hashing, and then accepts the hash as the authentication credential...

CVE-2025-48927

The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025...

PT-2025-23110

Name of the Vulnerable Software and Affected Versions TeleMessage service through 2025-05-05 Description The issue concerns the configuration of Spring Boot Actuator with an exposed heap dump endpoint at the "/heapdump" URI. This has been exploited in the wild in May 2025. Recommendations For...

TeleMessage security vulnerabilities

TeleMessage is a secure and compliant messaging solution for organizations from TeleMessage Israel. A security vulnerability exists in TeleMessage version 2025-05-05 and earlier that stems from relying on the client to perform MD5 hashing and accept the hash as authentication credentials...

TeleMessage security vulnerabilities

TeleMessage is a secure and compliant messaging solution for organizations from TeleMessage Israel. A security vulnerability exists in TeleMessage version 2025-05-05 and earlier, which stems from an administrative panel that allows an attacker to discover usernames, email addresses, passwords, an...

TeleMessage security vulnerabilities

TeleMessage is a secure and compliant messaging solution for organizations from TeleMessage Israel. A security vulnerability exists in TeleMessage version 2025-05-05 and earlier, which stems from the heap content of a JSP application containing a password sent over HTTP...

TeleMessage security vulnerabilities

TeleMessage is a secure and compliant messaging solution for organizations from TeleMessage Israel. A security vulnerability exists in TeleMessage version 2025-05-05 and earlier, which stems from exposing a heap dump endpoint when configuring Spring Boot Actuator...

TeleMessage security vulnerabilities

TeleMessage is a secure and compliant messaging solution for organizations from TeleMessage Israel. A security vulnerability exists in TeleMessage version 2025-05-05 and earlier, which stems from the use of MD5 for password hashing and could lead to a rainbow table attack...

TeleMessage security vulnerabilities

TeleMessage is a secure and compliant messaging solution for organizations from TeleMessage Israel. A security vulnerability exists in TeleMessage version 2025-05-05 and earlier, which stems from storing plaintext messages in memory, which could lead to message disclosure...