The use of HTTP for photo transport and a flaw in Tinder’s use of HTTPS can leave users exposed, Checkmarx says.

Two IP cameras sold by Loftek and VStartcam are leaving over 1.3 million users open to 21 vulnerabilities that range from a lack of HTTPS encryption to bugs that open users up to cross-site request forgery attacks.