Zombie Diary - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Zombie Diary published at the 'play' market has multiple vulnerabilities...

CVE-2014-7552

The Zombie Diary aka com.ezjoy.feelingtouch.zombiediary application 1.2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7552

CVE-2014-7552 affects the Android app “Zombie Diary” (package com.ezjoy.feelingtouch.zombiediary) version 1.2.2. The root cause is that the app does not validate X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a craft...