TeleMessage vulnerabilities
9 published CVEs name TeleMessage among the affected products; CISA lists 3 of them as exploited in the wild.
- Published CVEs
- 9
- Last 12 months
- 0
- Critical
- 0
- Known exploited
- 3
Critical 0High 0Medium 6Low 3Not scored 0
Known exploitedNewest addition to KEV first
- CVE-2025-48927
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in…
TeleMessage · service
ExploitedMedium5.3 - CVE-2025-48928
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password…
TeleMessage · service
ExploitedMedium4.0 - CVE-2025-47729
The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different…
TeleMessage · archiving backend
ExploitedLow1.9
Newest CVEs
- CVE-2025-48931
The TeleMessage service through 2025-05-05 relies on MD5 for password hashing, which opens up various attack possibilities (including rainbow tables) with low…
TeleMessage · service
Low3.2 - CVE-2025-48930
The TeleMessage service through 2025-05-05 stores certain cleartext information in memory, even though memory content may be accessible to an adversary through…
TeleMessage · service
Low2.8 - CVE-2025-48929
The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expiration time) that can…
TeleMessage · service
Medium4.0 - CVE-2025-48928
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password…
TeleMessage · service
ExploitedMedium4.0 - CVE-2025-48927
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in…
TeleMessage · service
ExploitedMedium5.3 - CVE-2025-48926
The admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail addresses, passwords, and telephone numbers.
TeleMessage · service
Medium4.3 - CVE-2025-48925
The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then accepts the hash as the authentication…
TeleMessage · service
Medium4.3 - CVE-2025-47730
The TeleMessage archiving backend through 2025-05-05 accepts API calls (to request an authentication token) from the TM SGNL (aka Archive Signal) app with the…
TeleMessage · archiving backend
Medium4.8 - CVE-2025-47729
The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different…
TeleMessage · archiving backend
ExploitedLow1.9