GHSA-56CX-WF47-HX7W No Restriction of Excessive Authentication Attempts in Firefly III

firefly-iii is vulnerable to Improper Lack of Restriction of Excessive Authentication Attempts...

firefly-iii has unspecified vulnerabilities

firefly-iii is a free and open source personal finance manager. firefly-iii suffers from a security vulnerability that stems from the program being susceptible to undue restrictions on excessive authentication attempts. No detailed vulnerability details are currently available...

Insecure Authentication

firefly-iii has insecure authentication. The vulnerability exists due to Improper Restriction of Excessive Authentication Attempts allowing an attacker to be able to gain access through brute forcing the login with a correct password list...

CVE-2021-3663

firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts...

CVE-2021-3663

firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts...

Input validation

firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts...

CVE-2021-3663

firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts...

CVE-2021-3663

Firefly-III is affected by CVE-2021-3663: Improper Restriction of Excessive Authentication Attempts. Affected software is the Firefly-III personal finance manager. Documented severity via CVSSv3.1 base score 7.5 (remote, no authentication, high confidentiality impact; network access, low attack c...

CVE-2021-3663 Improper Restriction of Excessive Authentication Attempts in firefly-iii/firefly-iii

firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts...

CVE-2021-3663: Improper Restriction of Excessive Authentication Attempts

firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts...

firefly-iii 安全漏洞

firefly-iii is a free and open source personal finance manager. firefly-iii suffers from a security vulnerability that stems from the program being susceptible to undue restrictions on excessive authentication attempts. No detailed vulnerability details are currently available...

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

✍️ Description The /export/export endpoint does not have CSRF Protection. This could be used to force download account data and potentially spoof users. 🕵️‍♂️ Proof of Concept - Login to user account. - Create the following file and open the page in browser. // PoC.html To verify that you are a...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. An attacker can inject malicious script via auto-completion suggestions for description field for new or edited transactions during adding transaction. This vulnerability is exploitable in a non-default configuration whereby th...

Firefly III Cross-Site Scripting Vulnerability (CNVD-2020-59725)

Firefly III is a free, open source, self-hosted personal finance manager. A cross-site scripting vulnerability exists in the auto-complete feature of the description field in Firefly III versions prior to 5.4.5. An attacker can exploit the vulnerability to execute JavaScript via the suggested...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape the user provided data in transaction description field and in asset account name, allowing an attacker to inject malicious script in a convert transaction to get executed upon ...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape the user provided data in the asset account name field, allowing an attacker to inject malicious script through it...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape the user provided data increate-from-bill name field, allowing an attacker to inject malicious script...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape the user provided data in liability name field, allowing an attacker to inject malicious script in a transaction to get executed upon an error condition during a visit to the...

Firefly III Cross-Site Scripting Vulnerability (CNVD-2019-30450)

Firefly III is a free, open source, self-hosted personal finance manager. A stored cross-site scripting vulnerability exists in Firefly III 4.7.17.3. The vulnerability stems from a lack of filtering of user-supplied data in the transaction description field. An attacker can exploit this...

Firefly III Cross-Site Scripting Vulnerability

Firefly III is a free, open source, self-hosted personal finance manager. A stored cross-site scripting vulnerability exists in Firefly III 4.7.17.5. The vulnerability stems from a lack of filtering of user-supplied data in the liabilityname field. An attacker can exploit the vulnerability to...