Firefly Iii Security Vulnerabilities
Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to Firefly III data using passwords stolen from...
5.9CVSS
6AI Score
0.0004EPSS
6.1CVSS
6.2AI Score
0.0005EPSS
Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to...
9.8CVSS
6.3AI Score
0.002EPSS
9.8CVSS
6.2AI Score
0.002EPSS
6.5CVSS
6.4AI Score
0.001EPSS
4.3CVSS
4.6AI Score
0.001EPSS
4.3CVSS
4.5AI Score
0.001EPSS
4.3CVSS
4.5AI Score
0.001EPSS
8.8CVSS
8.7AI Score
0.001EPSS
6.5CVSS
6.4AI Score
0.001EPSS
5.4CVSS
5.3AI Score
0.001EPSS
8.8CVSS
8.5AI Score
0.001EPSS
8.8CVSS
8.7AI Score
0.001EPSS
6.5CVSS
6.4AI Score
0.001EPSS
6.5CVSS
6.4AI Score
0.001EPSS
4.3CVSS
4.5AI Score
0.001EPSS
7.5CVSS
7.4AI Score
0.002EPSS
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed during rule-from-bill...
5.4CVSS
5.2AI Score
0.001EPSS
Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fints_url to import/job/configuration, and...
3.3CVSS
3.9AI Score
0.0004EPSS
Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field. The JavaScript code is executed upon an error condition during a visit to the account show...
5.4CVSS
5.2AI Score
0.001EPSS
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name. The JavaScript code is executed during a visit to the audit account statistics...
5.4CVSS
5.2AI Score
0.001EPSS
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field. The JavaScript code is executed during deletion of a transaction...
5.4CVSS
5.2AI Score
0.001EPSS
Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name. The JavaScript code is executed during a convert transaction...
6.1CVSS
6AI Score
0.001EPSS
Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name. The JavaScript code is contained in a transaction, and is executed on the tags/show/$tag_number$ tag summary page. NOTE: It is asserted that an attacker must have the same...
5.4CVSS
5.3AI Score
0.001EPSS
Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names. The JavaScript code is executed during attachments/edit/$file_id$ attachment editing. NOTE: It is asserted that an attacker must have the same access rights as the user in...
5.4CVSS
5.3AI Score
0.001EPSS
Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the...
5.4CVSS
5.3AI Score
0.001EPSS
Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/view/$file_id$ attachment viewing. NOTE: It is asserted that an attacker must have the same access rights as the user in....
5.4CVSS
5.3AI Score
0.001EPSS