{"items":[{"id":"CVE-2025-48931","published":"2025-05-28T00:00:00.000Z","updated":"2025-05-29T18:57:13.305Z","title":"The TeleMessage service through 2025-05-05 relies on MD5 for password hashing, which opens up various attack possibilities (including rainbow tables) with low…","severity":"LOW","score":3.2,"vendor":"TeleMessage","product":"service","kev":false,"epss":0.00099,"kevAdded":null},{"id":"CVE-2025-48930","published":"2025-05-28T00:00:00.000Z","updated":"2025-07-01T19:46:40.527Z","title":"The TeleMessage service through 2025-05-05 stores certain cleartext information in memory, even though memory content may be accessible to an adversary through…","severity":"LOW","score":2.8,"vendor":"TeleMessage","product":"service","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2025-48929","published":"2025-05-28T00:00:00.000Z","updated":"2025-07-01T19:47:22.186Z","title":"The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expiration time) that can…","severity":"MEDIUM","score":4,"vendor":"TeleMessage","product":"service","kev":false,"epss":0.00333,"kevAdded":null},{"id":"CVE-2025-48928","published":"2025-05-28T00:00:00.000Z","updated":"2026-02-26T18:27:52.827Z","title":"The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a \"core dump\" in which a password…","severity":"MEDIUM","score":4,"vendor":"TeleMessage","product":"service","kev":true,"epss":0.00577,"kevAdded":"2025-07-01"},{"id":"CVE-2025-48927","published":"2025-05-28T00:00:00.000Z","updated":"2026-02-26T18:27:53.525Z","title":"The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in…","severity":"MEDIUM","score":5.3,"vendor":"TeleMessage","product":"service","kev":true,"epss":0.12152,"kevAdded":"2025-07-01"},{"id":"CVE-2025-48926","published":"2025-05-28T00:00:00.000Z","updated":"2025-07-01T19:47:59.387Z","title":"The admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail addresses, passwords, and telephone numbers.","severity":"MEDIUM","score":4.3,"vendor":"TeleMessage","product":"service","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2025-48925","published":"2025-05-28T00:00:00.000Z","updated":"2025-07-01T19:48:30.412Z","title":"The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then accepts the hash as the authentication…","severity":"MEDIUM","score":4.3,"vendor":"TeleMessage","product":"service","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-47730","published":"2025-05-08T00:00:00.000Z","updated":"2025-05-08T15:41:48.292Z","title":"The TeleMessage archiving backend through 2025-05-05 accepts API calls (to request an authentication token) from the TM SGNL (aka Archive Signal) app with the…","severity":"MEDIUM","score":4.8,"vendor":"TeleMessage","product":"archiving backend","kev":false,"epss":0.00386,"kevAdded":null},{"id":"CVE-2025-47729","published":"2025-05-08T00:00:00.000Z","updated":"2025-10-21T22:55:16.821Z","title":"The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different…","severity":"LOW","score":1.9,"vendor":"TeleMessage","product":"archiving backend","kev":true,"epss":0.00447,"kevAdded":"2025-05-12"}]}