WikiAndPad alpha/beta: Improper export of Android application component
WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) for Android exports a headless activity without a permission or caller check. Any app installed on the same device can append text to the app's snippet store and, according to the advisory, read the stored snippets back through the app's own list screen. The CVE record describes data export by an unauthorized attacker, with no user interaction needed. The NVD score of 7.5 conflicts with the VulDB rating, and the advisory's mechanism has not been independently confirmed.
Michael Butscher · WikiAndPad alpha/beta
