CVE-2018-3986

MEDIUM Year: 2018
CVSS v3 Score
4.2
Medium
CVSS v2 Score
2.1
Low
Weakness Type
CWE-200
View all →

Vulnerability Description

An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android messaging application version 4.9.0. The "Secret Chats" functionality allows a user to delete all traces of a chat, either by using a time trigger or by direct request. There is a bug in this functionality that leaves behind photos taken and shared on the secret chats, even after the chats are deleted. These photos will be stored in the device and accessible to all applications installed on the Android device.

Related Vulnerabilities

CVE-2009-0783

MEDIUM
CVSS:4.2(Medium)

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read o...

CWE-2002009

CVE-2014-3591

MEDIUM
CVSS:4.2(Medium)

Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determin...

CWE-2002014

CVE-2017-13238

MEDIUM
CVSS:4.2(Medium)

In XBLRamDump mode, there is a debug feature that can be used to dump memory contents, if an attacker has physical access to the device. This could lead to local information disclosure with no additio...

CWE-2002017

CVE-2018-12076

MEDIUM
CVSS:4.2(Medium)

A vulnerability in the UPC bar code of the Avanti Markets MarketCard could allow an unauthenticated, local attacker to access funds within the customer's MarketCard balance, and also could lead to Cus...

CWE-2002018

CVE-2018-3987

MEDIUM
CVSS:4.2(Medium)

An exploitable information disclosure vulnerability exists in the 'Secret Chats' functionality of Rakuten Viber on Android 9.3.0.6. The 'Secret Chats' functionality allows a user to delete all traces ...

CWE-2002018

CVE-2018-8315

MEDIUM
CVSS:4.2(Medium)

An information disclosure vulnerability exists when the browser scripting engine improperly handle object types, aka "Microsoft Scripting Engine Information Disclosure Vulnerability." This affects Cha...

CWE-2002018