CVE-2021-41093

Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing the email. This issue has been resolved in version 3.86 which uses a new endpoint which additionally requires an authentication cookie. See...

CVE-2021-41093

Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing the email. This issue has been resolved in version 3.86 which uses a new endpoint which additionally requires an authentication cookie. See...

CVE-2021-41094

Wire is an open source secure messenger. Users of Wire by Bund may bypass the mandatory encryption at rest feature by simply disabling their device passcode. Upon launching, the app will attempt to enable encryption at rest by generating encryption keys via the Secure Enclave, however it will fai...

CVE-2021-41094

Wire is an open source secure messenger. Users of Wire by Bund may bypass the mandatory encryption at rest feature by simply disabling their device passcode. Upon launching, the app will attempt to enable encryption at rest by generating encryption keys via the Secure Enclave, however it will fai...

Design/Logic Flaw

Wire is an open source secure messenger. Users of Wire by Bund may bypass the mandatory encryption at rest feature by simply disabling their device passcode. Upon launching, the app will attempt to enable encryption at rest by generating encryption keys via the Secure Enclave, however it will fai...

CVE-2021-41094

Wire is an open source secure messenger. Users of Wire by Bund may bypass the mandatory encryption at rest feature by simply disabling their device passcode. Upon launching, the app will attempt to enable encryption at rest by generating encryption keys via the Secure Enclave, however it will fai...

Authentication flaw

Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing the email. This issue has been resolved in version 3.86 which uses a new endpoint which additionally requires an authentication cookie. See...

CVE-2021-41093

Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing the email. This issue has been resolved in version 3.86 which uses a new endpoint which additionally requires an authentication cookie. See...

CVE-2021-41094

CVE-2021-41094 affects Wire (wire-ios and related Wire apps) where encryption at rest can be bypassed if the device passcode is disabled or not set. On launch, the app attempts to enable encryption keys via the Secure Enclave but fails silently when no passcode is present, leaving users unaware t...

CVE-2021-41093

CVE-2021-41093 concerns Wire, an open-source secure messenger. Affected: Wire iOS components where an attacker with an old but valid access token could takeover the account by changing the user email. Root cause: improper session/token handling that allows account takeover. Impact: high risk (per...

CVE-2021-41093 Account takeover when having only access to a user's short lived token

Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing the email. This issue has been resolved in version 3.86 which uses a new endpoint which additionally requires an authentication cookie. See...

Facebook down with Messenger, Instagram, WhatsApp service disruption

By Waqas Facebook down? Yes, Facebook is down along with Messenger, Instagram, WhatsApp, and Oculus VR due to DNS-related issues. You are not alone; the social media giant Facebook along with its subsidiaries including Messenger, Instagram, WhatsApp, and Oculus VR are down and suffering ongoing...

LINE Credential Gatherer

This module searches for credentials in LINE desktop application on a Windows host. LINE is the most popular Instant Messenger app in Japan. Module Options msf use post/windows/gather/credentials/line msf postline show actions ...actions... msf postline set ACTION msf postline show options ...sho...

exploits

exploits Published PoCs can be found at exploitdb.comh...

VulnCheck KEV: CVE-2008-2551

The DownloaderActiveX Control DownloaderActiveX.ocx in Icona SpA C6 Messenger 1.0.0.1 allows remote attackers to force the download and execution of arbitrary files via a URL in the propDownloadUrl parameter with the propPostDownloadAction parameter set to "run."...

Facebook Adds End-to-End Encryption for Audio and Video Calls in Messenger

Facebook on Friday said it's extending end-to-end encryption E2EE for voice and video calls in Messenger, along with testing a new opt-in setting that will turn on end-to-end encryption for Instagram DMs. "The content of your messages and calls in an end-to-end encrypted conversation is protected...

The vulnerability of the LottieParserImpl::parseDashProperty function in the Telegram Messenger messaging application allows a hacker to disclose protected information.

The vulnerability of the LottieParserImpl::parseDashProperty function in the instant messaging application Telegram Messenger is caused by a buffer overflow in the queue. Exploiting this vulnerability could allow a malicious actor, operating remotely, to disclose sensitive information through the...

Hackers could access photos, videos without unlocking your phone

By Deeba Ahmed The vulnerability existed in the Facebook Messenger Rooms video chat feature and exposed Android smartphone users to intrusion. This is a post from HackRead.com Read the original post: Hackers could access photos, videos without unlocking your phone...

CVE-2021-32683

wire-webapp is the web version of Wire, an open-source messenger. A cross-site scripting vulnerability exists in wire-webapp prior to version 2021-06-01-production.0. If a user is instructed to open an image in a new tab right click - open in new tab, or copy the URL and paste it in the URL bar, ...

GHSA-V756-4WHV-48VC Code Injection in cd-messenger

cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution. User input provided to the color argument executed by the eval function resulting in code execution...