CVE-2019-15514

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is Nobody, because attackers can find these numbers via the Group Info feature, e.g., by adding a significant fraction of a region's assigned phone numbers.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://docs.google.com/document/d/e/2PACX-1vRx2wO2kj0axlQtv2CDSjPGlRKJOHtucvpOKGFKybh2eVVGZqvt_JJv-2Q11NHn5Y4um_F4-bgA6q5v/pubExploit, Third Party Advisory
https://docs.google.com/document/d/e/2PACX-1vRx2wO2kj0axlQtv2CDSjPGlRKJOHtucvpOKGFKybh2eVVGZqvt_JJv-2Q11NHn5Y4um_F4-bgA6q5v/pubExploit, Third Party Advisory

Timeline

Published: Aug 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-155156.5Discourse 2.3.2 sends the CSRF token in the query string.CVE-2019-155167.5Cuberite before 2019-06-11 allows webadmin directory traversal via ....// because the protection mechanism simply removes one ../ substring.CVE-2019-155175.5jc21 Nginx Proxy Manager before 2.0.13 allows %2e%2e%2f directory traversal.CVE-2019-155185.3Swoole before 4.2.13 allows directory traversal in swPort_http_static_handler.CVE-2019-155199.8Power-Response before 2019-02-02 allows directory traversal (up to the application's main directory) via a plugin.CVE-2019-15523.3OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in T CVE-2019-155205.3comelz Quark before 2019-03-26 allows directory traversal to locations outside of the project directory.CVE-2019-155219.8Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing a CVE-2019-155229.8An issue was discovered in LINBIT csync2 through 2.0. csync_daemon_session in daemon.c neglects to force a failure of a hello command when t CVE-2019-155235.3An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING_ALERT_RECEIVED of th CVE-2019-155249.8CSZ CMS 1.2.3 allows arbitrary file upload, as demonstrated by a .php file to admin/filemanager in the File Management Module, which leads t CVE-2019-155258.1There is Missing SSL Certificate Validation in the pw3270 terminal emulator before version 5.1.