CVE-2020-1904

A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have allowed for directory traversal overwriting files when sending specially crafted docx, xlsx, and pptx files as attachments to messages...

CVE-2020-1904

The CVE-2020-1904 entry describes a path validation issue in WhatsApp for iOS and WhatsApp Business for iOS (pre-2.20.61) that could allow directory traversal to overwrite files when attachments (docx, xlsx, pptx) are sent. The root cause is a path validation flaw that enables overwriting existin...

CVE-2020-1906

A buffer overflow in WhatsApp for Android prior to v2.20.130 and WhatsApp Business for Android prior to v2.20.46 could have allowed an out-of-bounds write when processing malformed local videos with E-AC-3 audio streams...

CVE-2020-1906

CVE-2020-1906 is a buffer overflow affecting WhatsApp for Android up to v2.20.130 and WhatsApp Business for Android up to v2.20.46, caused by an out-of-bounds write when processing malformed local videos with E-AC-3 audio streams. Multiple connected sources (NVD entry, Red Hat advisory, PRION lis...

CVE-2020-1902

CVE-2020-1902 : According to connected sources, the issue affects WhatsApp for Android and WhatsApp Business for Android, where a quick search on a highly forwarded message could have been sent to Google services over plain HTTP in versions around v2.20.108–v2.20.140 (WhatsApp) and v2.20.35–v2.20...

CVE-2020-1903

CVE-2020-1903 describes an out-of-memory denial-of-service in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 when unzipping docx, pptx, and xlsx attachments. The issue requires the recipient to open the attachment from a non-contact number to trigger the vulner...

CVE-2020-1903

An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resulted in an out-of-memory denial of service. This issue would have required the receiver to explicitly open the attachment if it was received...

CVE-2020-1902

A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or WhatsApp Business for Android from v2.20.35 to v2.20.49 could have been sent to the Google service over plain HTTP...

CVE-2020-1901

CVE-2020-1901 affects WhatsApp for iOS prior to v2.20.91.4. A large text message containing URLs could cause the app to freeze during processing. Affected component: WhatsApp iOS message processing; root cause: likely handling of long URL-containing text (specific fix not detailed in the provided...

CVE-2020-1901

Receiving a large text message containing URLs in WhatsApp for iOS prior to v2.20.91.4 could have caused the application to freeze while processing the message...

Android Spyware Variant Snoops on WhatsApp, Telegram Messages

Researchers say they have uncovered a new Android spyware variant with an updated command-and-control communication strategy and extended surveillance capabilities that snoops on social media apps WhatsApp and Telegram. The malware, Android/SpyC32.A, is currently being used in active campaigns...

Vulnerability Disclosure: Ethical Hackers Seek Best Practices

The process of vulnerability disclosure has improved over the years, but still too many security researchers face threats when trying to report bugs. Disclosure policies that give ethical hackers clear guidelines are vast and varied and are seldom universally followed, which adds to the friction...

Facebook Debuts Third-Party Vulnerability Disclosure Policy

Facebook has implemented a fresh security vulnerability disclosure policy VDP this week – in an effort to explain how it decides when and how to roll out details on various bugs that its team finds in third-party software and open-source projects. Generally speaking, companies will have 21 days t...

WhatsApp Discloses 6 Bugs via Dedicated Security Site

Facebook-owned WhatsApp has fixed six previously undisclosed vulnerabilities in its chat platform, revealing the move on a new dedicated security advisory site aimed at informing its more than 2 million users about bugs and keeping them updated on app security. The site is part of an effort by...

Will WhatsApp’s Misinfo Cure Work for Facebook Messenger?

To protect the election, the platform will limit message forwarding to five people at a time...

Facebook WhatsApp Desktop Cross-Site Scripting Vulnerability

Facebook WhatsApp is a suite of mobile applications from the American company Facebook that utilize the web to deliver text messages. The application uses the contact information in a smartphone to find contacts using the program to send texts, pictures, and more. A cross-site scripting...

WhatsApp elevation of privilege vulnerability

Facebook WhatsApp is a suite of mobile applications from Facebook Inc. in the United States that use the Internet to send text messages. The application uses the contact information in a smartphone to find contacts using the program to send texts, pictures, etc. WhatsApp Business is the commercia...

Google Android WhatsApp Information Disclosure Vulnerability

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA.System is one of the system components.Email is one of the email components.WhatsApp is a set of mobile applications that utilize the web to deliver text messages from Google and the Open Handheld...

CVE-2020-1886

A buffer overflow in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have allowed an out-of-bounds write via a specially crafted video stream after receiving and answering a malicious video call...

CVE-2020-1891

A user controlled parameter used in video call in WhatsApp for Android prior to v2.20.17, WhatsApp Business for Android prior to v2.20.7, WhatsApp for iPhone prior to v2.20.20, and WhatsApp Business for iPhone prior to v2.20.20 could have allowed an out-of-bounds write on 32-bit devices...