CVE-2023-2971

Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text fro...

CVE-2023-2316

Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious...

CVE-2023-2110

Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/". This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, or copies tex...

Design/Logic Flaw

Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious...

CVE-2023-2971 Typora Local File Disclosure

Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text fro...

CVE-2023-2971 Typora Local File Disclosure

Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text fro...

CVE-2023-2971

CVE-2023-2971 describes a path handling vulnerability in Typora prior to 1.7.0-dev on Windows and Linux. A crafted webpage or malicious markdown content can trigger access to local files and exfiltration to remote servers via the endpoint typora://app/typemark/. The risk is supported by multiple ...

CVE-2023-2316 Typora Local File Disclosure

Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious...

CVE-2023-2316

Typora (Windows/Linux) prior to 1.6.7 is affected by an improper path handling vulnerability that lets a crafted webpage access local files and exfiltrate them via the typora://app/ protocol. Exploitation can occur when a user opens a malicious Markdown file or pastes text from a malicious page, ...

CVE-2023-2316 Typora Local File Disclosure

Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious...

CVE-2023-2110 Obsidian Local File Disclosure

Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/". This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, or copies tex...

CVE-2023-2110 Obsidian Local File Disclosure

Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/". This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, or copies tex...

CVE-2023-2110

CVE-2023-2110 affects Obsidian Desktop prior to 1.2.8 across Windows, Linux and macOS. The issue is improper path handling that allows a crafted webpage to access local files and exfiltrate them to remote servers via app://local/. Exploitation requires user interaction: opening a malicious markdo...

CVE-2023-2110: Improper Limitation of a Pathname to a Restricted Directory

Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/ ". This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, or copies te...

Typora path traversal vulnerability

Typora is an editor. A path traversal vulnerability exists in Typora version 1.6.7, which stems from an improper path handling vulnerability that affects both Windows and Linux platforms...

PT-2023-22366 · Typora · Typora

Name of the Vulnerable Software and Affected Versions: Typora versions prior to 1.7.0-dev Description: The issue is related to improper path handling, which allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This can be exploited...

PT-2023-18866 · Typora · Typora

Name of the Vulnerable Software and Affected Versions: Typora versions prior to 1.6.7 Description: The issue is related to improper path handling, which allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/". This can be exploited if a user...

PT-2023-17894

Name of the Vulnerable Software and Affected Versions Obsidian desktop versions prior to 1.2.8 Description The issue is related to improper path handling, allowing a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/". This can be exploited if a user...

BioTime iclock Interface File Read

The vulnerability of the iclock interface on the BioTime time tracking management web platform is related to errors in processing the relative path to the catalog. Exploiting this vulnerability can allow an attacker operating remotely to gain read access to arbitrary files...

Onlyoffice Community Server UploadProgress.ashx Code Execution

The vulnerability of the UploadProgress.ashx component of the Onlyoffice Community Server system is related to errors in processing the relative path to the restricted access directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...