DaOffice Chat - Customized SSL, Dangerous filesystem permissions, MIT license vulnerabilities

Name

Vendor

Link

Store

Version

• CRITICAL
Dangerous filesystem permissions

Files created with these methods could be worldwide readable.

MIT license

The app should be compliant with open source license requirements.

Customized SSL

Check certificate validation. Do not create or redefine X509Certificate class methods by yourself, if you don't understand risks. Use the existing API.

• MEDIUM
Exported components

Other applications could access the interfaces.

SD-card access

SD-cards and other external storages have 'worldwide read' policy.

• NOTICE
KeyStore usage

The app uses Android KeyStore subsystem.

Unsafe deleting

All items deleted with 'file.delete()' could be recovered.

External URLs

Were do they point?

Suspicious files

Are you sure these files should be here?

References