Vulnerabilities > Signal > Medium

DATE CVE VULNERABILITY TITLE RISK
2022-04-15 CVE-2022-28345 Injection vulnerability in Signal
The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection.
network
low complexity
signal CWE-74
5.0
2020-05-20 CVE-2020-5753 Always-Incorrect Control Flow Implementation vulnerability in Signal
Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disclose currently used DNS server due to ICE Candidate handling before call is answered or declined.
network
low complexity
signal CWE-670
5.0
2019-12-24 CVE-2019-19954 Uncontrolled Search Path Element vulnerability in Signal Signal-Desktop
Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\node_modules\.bin\wmic.exe file.
local
signal CWE-427
6.9
2019-10-05 CVE-2019-17191 Improper Input Validation vulnerability in Signal Private Messenger
The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interaction, via a connect message.
network
low complexity
signal CWE-20
5.0
2019-03-24 CVE-2019-9970 Unspecified vulnerability in Signal Signal-Desktop
Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages containing URLs.
network
signal
4.3
2018-12-10 CVE-2018-3988 Information Exposure vulnerability in Signal Private Messenger 4.24.8
Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses the photo feature available in the "attach file" menu, then Signal will leave the picture in its own cache directory, which is available to any application on the system.
local
high complexity
signal CWE-200
4.7
2018-05-17 CVE-2018-11101 Cross-site Scripting vulnerability in Signal Signal-Desktop
Open Whisper Signal (aka Signal-Desktop) through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994.
network
signal CWE-79
4.3
2018-05-14 CVE-2018-10994 Cross-site Scripting vulnerability in Signal Signal-Desktop
js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL.
network
signal CWE-79
4.3
2018-04-10 CVE-2018-9840 Unspecified vulnerability in Signal
The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass the screen locker feature via certain rapid sequences of actions that include app opening, clicking on cancel, and using the home button.
local
low complexity
signal
4.6