CVE-2025-48927

CVE-2025-48927 concerns TeleMessage service configuring Spring Boot Actuator with an exposed /heapdump endpoint. Connected sources confirm the heapdump exposure stems from Actuator configuration and is implicated by multiple advisories (NVD entry, CISA KEV listing, and related GitHub/GHSA advisor...

CVE-2025-48928

CVE-2025-48928 affects the TeleMessage service (TeleMessage TM SGNL) running a JSP-based application up to 2025-05-05. The issue is that heap content can resemble a core dump, exposing passwords previously sent over HTTP within that dump. Exploitation was observed in the wild in May 2025. Public ...

CVE-2025-47730

The TeleMessage archiving backend (versions through 2025-05-05 ) is vulnerable to an authentication bypass due to the use of hardcoded credentials . The system accepts API calls from the TM SGNL (Archive Signal) app requesting authentication tokens using the username logfile and the password enRR...

CVE-2025-48929

The TeleMessage service (version 2025-05-05 and earlier) is vulnerable to credential reuse because it implements authentication using long-lived credentials instead of short-lived tokens. An adversary who discovers these credentials can reuse them at a later date to gain unauthorized access. This...

CVE-2025-48925

The TeleMessage service (version 2025-05-05 and earlier) is vulnerable because it relies on the client side (e.g., the TM SGNL app ) to perform MD5 hashing and then accepts that hash as a valid authentication credential. This architectural flaw allows for potential authentication bypass or creden...

CVE-2025-48931

The CVE-2025-48931 entry concerns TeleMessage service passwords hashed with MD5 (through 2025-05-05). Root cause: MD5-based password hashing enabling rainbow-table and related attacks with low computational effort. Impact is implied as password-cryptography weakness; no explicit exploited vector ...

CVE-2025-48930

The TeleMessage service (version 2025-05-05 and earlier) contains a vulnerability where certain cleartext information is stored in memory. Because memory content may be accessible to an adversary through various avenues, this flaw could lead to message disclosure . Real-world exploitation of this...

CVE-2025-48926

The TeleMessage service (versions through 2025-05-05 ) contains a security vulnerability in its admin panel that allows attackers to discover sensitive information, including usernames , e-mail addresses , passwords , and telephone numbers . This vulnerability has been exploited in the wild . As ...