Vulnerabilities

TI-2023-09844 CVE-2023-24069 · GHSA-2cqm-w497-9r99

Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain…

MEDIUM 49

Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments sent in messages from the attachments.noindex directory.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00869 Published 2023-01-23 No fix listed CWE-200

TI-2023-09843 CVE-2023-24068 · GHSA-wrv4-jq6j-75pm

Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify…

HIGH 69

Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify conversation attachments within the attachments.noindex directory.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00376 Published 2023-01-23 No fix listed

TI-2019-14393 CVE-2019-19954 · GHSA-2gph-9fp2-pqq3

Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating…

LOW 33

Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\node_modules\.bin\wmic.exe file.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.00481 Published 2019-12-24 No fix listed CWE-427

TI-2019-07336 CVE-2019-9970 · GHSA-9p53-vpmw-2w5c

Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger…

LOW 33

Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages containing URLs.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.01834 Published 2019-03-24 No fix listed

TI-2018-10135 CVE-2018-14023 · GHSA-8392-9r3r-6m6x

Open Whisper Signal (aka Signal-Desktop) before 1.15.0-beta.10 allows information leakage.

LOW 19

Open Whisper Signal (aka Signal-Desktop) before 1.15.0-beta.10 allows information leakage.

CVSS 3.0MEDIUM 4.0 Local No auth No interaction EPSS 0.0047 Published 2018-08-20 No fix listed CWE-200

TI-2018-07885 CVE-2018-11101 · GHSA-hf9p-487c-2v2r

Open Whisper Signal (aka Signal-Desktop) through 1.10.1 allows XSS via a resource…

LOW 30

Open Whisper Signal (aka Signal-Desktop) through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnera…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01396 Published 2018-05-17 No fix listed CWE-79

TI-2018-07792 CVE-2018-10994 · GHSA-p95x-2rhj-jcfg

js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL.

LOW 30

js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01311 Published 2018-05-14 No fix listed CWE-79

Vulnerabilities

Filters

Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain…

Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify…

Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating…

Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger…

Open Whisper Signal (aka Signal-Desktop) before 1.15.0-beta.10 allows information leakage.

Open Whisper Signal (aka Signal-Desktop) through 1.10.1 allows XSS via a resource…

js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL.