Obsidian 安全漏洞

Obsidian is a knowledge base for native Markdown files from the Obsidian community. A security vulnerability exists in versions of Obsidian prior to 1.2.2 that stems from allowing unintended API calls via embedded web pages...

CVE-2023-27035

An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page...

Code injection

An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page...

Obsidian 安全漏洞

Obsidian is a knowledge base for native Markdown files from the Obsidian community. A security vulnerability exists in Obsidian Canvas version 1.1.9 that originates from a vulnerability that allows remote attackers to send desktop notifications, record user audio, and other unspecified impacts vi...

CVE-2023-27035

An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page...

CVE-2023-27035

CVE-2023-27035 affects Obsidian Canvas 1.1.9. The issue allows remote attackers to trigger sensitive Web APIs from embedded pages on the canvas, enabling actions such as sending desktop notifications and recording the user’s audio without explicit user permission. The root cause, as described in ...

CVE-2023-27035

An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page...

PT-2023-20910 · Unknown · Obsidian Canvas

Name of the Vulnerable Software and Affected Versions: Obsidian Canvas version 1.1.9 Description: An issue in Obsidian Canvas allows remote attackers to send desktop notifications, record user audio, and potentially have other unspecified impacts. This can be achieved via an embedded website on t...

CVE-2023-27035

An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page...

Plesk Obsidian <=18.0.49 - Open Redirect

Plesk Obsidian through 18.0.49 contains an open redirect vulnerability via the login page. An attacker can redirect users to malicious websites via a host request header and thereby access user credentials and execute unauthorized operations. NOTE: The vendor's position is "the ability to use...

CVE-2023-24044

A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature."...

CVE-2023-24044

A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature."...

Design/Logic Flaw

DISPUTED A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature."...

CVE-2023-24044

A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature."...

CVE-2023-24044

A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature."...

CVE-2023-24044

CVE-2023-24044 affects Plesk Obsidian up to version 18.0.49. The login page is vulnerable to Host header injection, enabling open redirects to attacker‑controlled sites. Root cause appears to be reliance on the Host header to grant access or redirect, with vendor noting that arbitrary domain name...

Plesk Obsidian 输入验证错误漏洞

Plesk Obsidian is a hosting control panel from Plesk Switzerland. An input validation error vulnerability exists in Plesk Obsidian version 18.0.49 and prior versions. An attacker could exploit this vulnerability to redirect users to a malicious website via the host request header...

PT-2023-6601 · Plesk · Plesk Obsidian

Name of the Vulnerable Software and Affected Versions: Plesk Obsidian versions through 18.0.49 Description: A Host Header Injection issue on the Login page allows attackers to redirect users to malicious websites via a Host request header. The issue is related to the ability to use arbitrary doma...

CVE-2022-45130

Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version numbers were used through version 12, and then the convention was changed so that versions are identified by names...

Cross site request forgery (csrf)

Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version numbers were used through version 12, and then the convention was changed so that versions are identified by names...