CVSS: 8.2EPSS: 0%CPEs: 4EXPL: 1CVE-2023-2110 – Obsidian Local File Disclosure
https://notcve.org/view.php?id=CVE-2023-2110
19 Aug 2023 — Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/<absolute-path>". This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, or copies text from a malicious webpage and paste it into Obsidian. • https://obsidian.md/changelog/2023-05-03-desktop-v1.2.8 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-33244
https://notcve.org/view.php?id=CVE-2023-33244
20 May 2023 — Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notification) via an embedded web page. • https://forum.obsidian.md/t/obsidian-release-v1-2-2-insider-build/57488 •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 2CVE-2023-27035
https://notcve.org/view.php?id=CVE-2023-27035
01 May 2023 — An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page. • https://github.com/fivex3/CVE-2023-27035 • CWE-276: Incorrect Default Permissions •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 2CVE-2023-24044
https://notcve.org/view.php?id=CVE-2023-24044
22 Jan 2023 — A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature." Un problema de inyección de encabezado de host en la página de inicio de sesión de Plesk Obsidian hasta 18.0.49 permite a los atacantes redirigir a los usuarios a sitios web maliciosos a través de un encabezado de solicitud de ... • https://github.com/Cappricio-Securities/CVE-2023-24044 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2022-36450
https://notcve.org/view.php?id=CVE-2022-36450
25 Jul 2022 — Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL. Obsidian versiones 0.14.x y 0.15.x anteriores a 0.15.,5 permite la ejecución de código remota obsidian://hook-get-address porque es usado window.open sin comprobar la URL • https://forum.obsidian.md/t/possible-remote-code-execution-through-obsidian-uri-scheme/39743 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-35976
https://notcve.org/view.php?id=CVE-2021-35976
10 Sep 2021 — The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-62467. The attacker could execute JavaScript code in the victim's browser by using the link to preview sites hosted on the server. Authentication is not required to exploit the vulnerability. La funcionalidad para previsualizar un sitio web en Plesk Obsidian 18.0.0 a 18.0.32 en Linux es vulnerable a XSS reflejado a través de /plesk-site-preview/ PATH, ... • https://support.plesk.com/hc/en-us/articles/4402990507026 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-38148
https://notcve.org/view.php?id=CVE-2021-38148
07 Aug 2021 — Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs. Obsidian versiones anteriores a 0.12.12, no requiere la confirmación del usuario para las URLs no http/https • https://forum.obsidian.md/t/obsidian-release-v0-12-12/21564 •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-11583
https://notcve.org/view.php?id=CVE-2020-11583
03 Aug 2020 — A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter. Una vulnerabilidad de tipo XSS reflejada basada en GET en Plesk Obsidian versión 18.0.17, permite a usuarios remotos no autenticados inyectar JavaScript, HTML o CSS arbitrario por medio de un parámetro GET • https://medium.com/%400x00crash/xss-reflected-in-plesk-onyx-and-obsidian-1173a3eaffb5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •