CVE-2024-37893: Improper Authentication

Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to Firefly III data using passwords stolen from...

Firefly III Security Vulnerability

Firefly III is an open source personal finance management system. A security vulnerability exists in Firefly III versions prior to 6.1.17, which stems from a vulnerability that could allow a malicious user to bypass multiple authentication checks...

PT-2024-27815

Name of the Vulnerable Software and Affected Versions Firefly III versions prior to 6.1.17 Description A bypass of the multi-factor authentication MFA check in the Firefly III OAuth flow may allow malicious users to access Firefly III data using passwords stolen from other sources. This can be...

CSV Injection

firefly-iii is vulnerable to CSV Injection vulnerability. The vulnerability is due to un-escaped user input in CSV files. This issue can be exploited by an attacker resulting in unauthorized access or manipulation of data when opening the csv file...

C5 Firefly III CSV Injection.

Summary CSV injection is a vulnerability where untrusted user input in CSV files can lead to unauthorized access or data manipulation. In my subsequent testing of the application. Details I discovered that there is an option to "Export Data" from the web app to your personal computer, which expor...

PT-2024-40020 · Microsoft · Office Excel

Name of the Vulnerable Software and Affected Versions: Firefly III affected versions not specified Description: The issue allows unauthorized access or data manipulation through CSV injection, where untrusted user input in CSV files can lead to malicious actions. The web application has an "Expor...

HTML Injection

grumpydictator/firefly-iii is vulnerable to HTML Injection. The vulnerability is caused due to improper sanitization in webhooks features. This allows an attacker to inject malicious HTML content by submitting specially crafted input...

GHSA-VWV2-9WCJ-64VX Firefly III allows webhooks HTML Injection.

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

Firefly III allows webhooks HTML Injection.

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

CVE-2024-22075

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

Design/Logic Flaw

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

CVE-2024-22075: Improper Neutralization of Input During Web Page Generation

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

Firefly III Security Vulnerability

Firefly III is an open source personal finance management system. A security vulnerability exists in Firefly III before 6.1.1, which stems from allowing webhooks HTML injection...

CVE-2024-22075

Firefly III before 6.1.1 allows HTML Injection via webhooks due to improper sanitization in webhook handling. Affected product: Firefly III (web application). Root cause: inadequate sanitization of webhook inputs leading to HTML injection. Impact: potential exposure/impact limited to confidential...

CVE-2024-22075

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

CVE-2024-22075

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

CVE-2024-22075

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

Malicious code in firefly-utilities-helper-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7d1e40a9479f8d7f46dde5d530c7da4a5ac550607ec867806525a3bb749d6e76 The OpenSSF Package Analysis project identified 'firefly-utilities-helper-ts' @ 1.1.14 npm as malicious. It is considered malicious because: - T...

Malicious code in @marcomayo.com/firefly-shared-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a546d2e7e1826bee115fabca6b2802aab96ca9f227b6998e3ff64ca63459fc00 The OpenSSF Package Analysis project identified '@marcomayo.com/firefly-shared-js' @ 1.999.0 npm as malicious. It is considered malicious becaus...

Malicious code in firefly-shared-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 540259a2eb130bcb8b4596b7a6458b6290bd5dd6b8846751f0475931083f7594 Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...