Obsidian records
6 published records for vendor obsidian.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 1
- With a fix record
- 33.3%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-20 Improper Input Validation1
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1
- CWE-276 Incorrect Default Permissions1
- CWE-94 Improper Control of Generation of Code ('Code Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
6 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
45Plan | CVE-2022-36450No exploit | Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checkiobsidian · obsidian · CWE-20 | Critical9.8 | — | 20.5% | Jul 25, 2022 |
39Monitor | CVE-2021-38148No exploit | Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs.obsidian · obsidian | Critical9.8 | — | 1.2% | Aug 6, 2021 |
32Monitor | CVE-2023-33244No exploit | Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notification) via an embedded web pobsidian · obsidian | High8.2 | — | 0.4% | May 20, 2023 |
31Monitor | CVE-2023-27035Proof of concept | An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified obsidian · obsidian · CWE-276 | High7.5 | — | 1.8% | May 1, 2023 |
31Monitor | CVE-2021-42057No exploit | Obsidian Dataview through 0.4.12-hotfix1 allows eval injection.obsidian · obsidian dataview · CWE-94 | High7.8 | — | 1.2% | Nov 4, 2021 |
28Monitor | CVE-2023-2110No exploit | Obsidian Local File Disclosureobsidian · obsidian · CWE-22 | High7.1 | — | 0.3% | Aug 19, 2023 |
- CVE-2022-3645045Plan
Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checki
CriticalCVSS 9.8No exploitEPSS 20%obsidian · obsidianJul 25, 2022
- CVE-2021-3814839Monitor
Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs.
CriticalCVSS 9.8No exploitEPSS 1%obsidian · obsidianAug 6, 2021
- CVE-2023-3324432Monitor
Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notification) via an embedded web p
HighCVSS 8.2No exploitEPSS 0%obsidian · obsidianMay 20, 2023
- CVE-2023-2703531Monitor
An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified
HighCVSS 7.5Proof of conceptEPSS 1%obsidian · obsidianMay 1, 2023
- CVE-2021-4205731Monitor
Obsidian Dataview through 0.4.12-hotfix1 allows eval injection.
HighCVSS 7.8No exploitEPSS 1%obsidian · obsidian dataviewNov 4, 2021
- CVE-2023-211028Monitor
Obsidian Local File Disclosure
HighCVSS 7.1No exploitEPSS 0%obsidian · obsidianAug 19, 2023