7.5

CVE-2017-15581

In the "Diary with lock" (aka WriteDiary) application 4.72 for Android, neither HTTPS nor other encryption is used for transmitting data, despite the documentation that the product is intended for "a personal journal of ... secrets and feelings," which allows remote attackers to obtain sensitive information by sniffing the network during LoginActivity or NoteActivity execution.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Writediary ≫ Diary With Lock Version4.72 SwPlatformandroid
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.85% 0.534
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-311 Missing Encryption of Sensitive Data

The product does not encrypt sensitive or critical information before storage or transmission.

https://1337sec.blogspot.de/2017/10/auditing-writediarycom-cve-2017-15581.html
Third Party Advisory
Issue Tracking
https://gist.github.com/anonymous/603b89f864a71426042b167cab557efa
Third Party Advisory
Issue Tracking