) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
Search Results (Refine Search)
Search Parameters:
- Keyword (text search): cpe:2.3:a:obsidian:obsidian:0.12.7:*:*:*:*:*:*:*
- CPE Name Search: true
There are 3 matching records.
Displaying matches 1 through 3.
| Vuln ID | Summary | CVSS Severity |
|---|---|---|
| CVE-2023-2110 |
Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/<absolute-path>". This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, or copies text from a malicious webpage and paste it into Obsidian. Published: August 19, 2023; 2:15:45 AM -0400 |
V4.0:(not available) V3.1: 7.1 HIGH V2.0:(not available) |
| CVE-2023-33244 |
Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notification) via an embedded web page. Published: May 20, 2023; 3:15:08 PM -0400 |
V4.0:(not available) V3.1: 8.2 HIGH V2.0:(not available) |
| CVE-2021-38148 |
Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs. Published: August 06, 2021; 11:15:06 PM -0400 |
V4.0:(not available) V3.1: 9.8 CRITICAL V2.0: 7.5 HIGH |