CVE-2018-11101

CVE-2018-11101 affects Signal Desktop (Open Whisper Signal) up to version 1.10.1. The vulnerability arises from incorrect handling of HTML when rendering quoted-reply messages, allowing XSS via HTML injected in a message that is later quoted/replied to. The root cause involved React dangerouslySe...

CVE-2018-11101

Open Whisper Signal aka Signal-Desktop through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994. The attacker needs to send HTML code directly as a...

CVE-2018-11101: Improper Neutralization of Input During Web Page Generation

Open Whisper Signal aka Signal-Desktop through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994. The attacker needs to send HTML code directly as a...

PT-2018-10309

Name of the Vulnerable Software and Affected Versions Open Whisper Signal aka Signal-Desktop versions through 1.10.1 Description The issue allows for cross-site scripting XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution aft...

Open Whisper Signal Cross-Site Scripting Vulnerability

Open Whisper Signal aka Signal-Desktop is a live chat application with encryption. A cross-site scripting vulnerability exists in the js/views/messageview.js file in Open Whisper Signal versions prior to 1.10.1. A remote attacker can exploit this vulnerability to inject arbitrary web script or HT...

Open redirect

js/views/messageview.js in Open Whisper Signal aka Signal-Desktop before 1.10.1 allows XSS via a URL...

CVE-2018-10994

js/views/messageview.js in Open Whisper Signal aka Signal-Desktop before 1.10.1 allows XSS via a URL...

CVE-2018-10994

js/views/messageview.js in Open Whisper Signal aka Signal-Desktop before 1.10.1 allows XSS via a URL...

CVE-2018-10994

js/views/messageview.js in Open Whisper Signal aka Signal-Desktop before 1.10.1 allows XSS via a URL...

CVE-2018-10994

js/views/messageview.js in Open Whisper Signal aka Signal-Desktop before 1.10.1 allows XSS via a URL...

CVE-2018-10994

Open Whisper Signal (Signal-Desktop)

PT-2018-10232

Name of the Vulnerable Software and Affected Versions Open Whisper Signal aka Signal-Desktop versions prior to 1.10.1 Description The issue allows for XSS via a URL in the js/views/message view.js file. Recommendations For versions prior to 1.10.1, update to version 1.10.1 or later to resolve the...

CVE-2018-10994: Improper Neutralization of Input During Web Page Generation

js/views/messageview.js in Open Whisper Signal aka Signal-Desktop before 1.10.1 allows XSS via a URL...

CVE-2018-9840

The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass the screen locker feature via certain rapid sequences of actions that include app opening, clicking on cancel, and using the home button...

Open redirect

The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass the screen locker feature via certain rapid sequences of actions that include app opening, clicking on cancel, and using the home button...

CVE-2018-9840

The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass the screen locker feature via certain rapid sequences of actions that include app opening, clicking on cancel, and using the home button...

CVE-2018-9840

The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass the screen locker feature via certain rapid sequences of actions that include app opening, clicking on cancel, and using the home button...

CVE-2018-9840

The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass the screen locker feature via certain rapid sequences of actions that include app opening, clicking on cancel, and using the home button...

CVE-2018-9840

The CVE-2018-9840 entry concerns the iOS Open Whisper Signal app prior to version 2.23.2. Affected component is the screen locker feature, which can be bypassed by physically proximate attackers through a rapid sequence of actions: opening the app, selecting cancel, and pressing the home button. ...

CVE-2018-9840: Undefined Security Weakness

The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass the screen locker feature via certain rapid sequences of actions that include app opening, clicking on cancel, and using the home button...