CVE-2018-6018

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Fixed sizes of HTTPS responses in Tinder iOS app and Tinder Android app allow an attacker to extract private sensitive information by sniffing network traffic.

Metrics

CVSS 3.0 9.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.checkmarx.com/2018/01/23/tinder-someone-may-watching-swipe-2/Third Party Advisory
https://www.wired.com/story/tinder-lack-of-encryption-lets-strangers-spy-on-swipes/Press/Media Coverage, Third Party Advisory
https://www.checkmarx.com/2018/01/23/tinder-someone-may-watching-swipe-2/Third Party Advisory
https://www.wired.com/story/tinder-lack-of-encryption-lets-strangers-spy-on-swipes/Press/Media Coverage, Third Party Advisory

Timeline

Published: Jan 24, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-60195.9Samsung Display Solutions App before 3.02 for Android allows man-in-the-middle attackers to spoof B2B content by leveraging failure to use e CVE-2018-60206.5In Silex SX-500 all versions and GE MobileLink(GEH-500) version 1.54 and prior, authentication is not verified when making certain POST requ CVE-2018-60217.4Silex SD-320AN version 2.01 and prior and GE MobileLink(GEH-SD-320AN) version GEH-1.1 and prior have a system call parameter that is not pro CVE-2018-60226.5Directory traversal vulnerability in application/admin/controller/Main.php in NoneCms through 1.3.0 allows remote authenticated users to del CVE-2018-60238.8Fastweb FASTgate 0.00.47 devices are vulnerable to CSRF, with impacts including Wi-Fi password changing, Guest Wi-Fi activating, etc.CVE-2018-60249.8SQL Injection exists in the Project Log 1.5.3 component for Joomla! via the search parameter.CVE-2018-60297.5The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and CVE-2018-60318.8Use after free in PDFium in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a craf CVE-2018-60326.5Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-or CVE-2018-60338.8Insufficient data validation in Downloads in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary cod CVE-2018-60348.1Insufficient data validation in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory r CVE-2018-60358.8Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local