519 matches found
GHSA-4GM4-C4MH-4P7W Firefly III has a MFA bypass in oauth flow
Impact A MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to your Firefly III data using passwords stolen from other sources. As OAuth applications are easily enumerable using an...
CVE-2024-37893
Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to Firefly III data using passwords stolen from...
CVE-2024-37893 MFA bypass in oauth flow in Firefly III
Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to Firefly III data using passwords stolen from...
CVE-2024-37893 MFA bypass in oauth flow in Firefly III
Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to Firefly III data using passwords stolen from...
CVE-2024-37893
Firefly III Vulnerability (CVE-2024-37893): A MFA bypass in the Firefly III OAuth flow could allow an attacker to bypass MFA and access data via password spraying, leveraging compromised passwords from other sources. Attackers could enumerate OAuth applications (due to incrementing IDs) to target...
CVE-2024-37893 MFA bypass in oauth flow in Firefly III
Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to Firefly III data using passwords stolen from...
Firefly III Security Vulnerability
Firefly III is an open source personal finance management system. A security vulnerability exists in Firefly III versions prior to 6.1.17, which stems from a vulnerability that could allow a malicious user to bypass multiple authentication checks...
PT-2024-27815
Name of the Vulnerable Software and Affected Versions Firefly III versions prior to 6.1.17 Description A bypass of the multi-factor authentication MFA check in the Firefly III OAuth flow may allow malicious users to access Firefly III data using passwords stolen from other sources. This can be...
CSV Injection
firefly-iii is vulnerable to CSV Injection vulnerability. The vulnerability is due to un-escaped user input in CSV files. This issue can be exploited by an attacker resulting in unauthorized access or manipulation of data when opening the csv file...
C5 Firefly III CSV Injection.
Summary CSV injection is a vulnerability where untrusted user input in CSV files can lead to unauthorized access or data manipulation. In my subsequent testing of the application. Details I discovered that there is an option to "Export Data" from the web app to your personal computer, which expor...
PT-2024-40020 · Microsoft · Office Excel
Name of the Vulnerable Software and Affected Versions: Firefly III affected versions not specified Description: The issue allows unauthorized access or data manipulation through CSV injection, where untrusted user input in CSV files can lead to malicious actions. The web application has an "Expor...
HTML Injection
grumpydictator/firefly-iii is vulnerable to HTML Injection. The vulnerability is caused due to improper sanitization in webhooks features. This allows an attacker to inject malicious HTML content by submitting specially crafted input...
GHSA-VWV2-9WCJ-64VX Firefly III allows webhooks HTML Injection.
Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...
Firefly III allows webhooks HTML Injection.
Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...
CVE-2024-22075
Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...
Design/Logic Flaw
Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...
CVE-2024-22075
Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...
Firefly III Security Vulnerability
Firefly III is an open source personal finance management system. A security vulnerability exists in Firefly III before 6.1.1, which stems from allowing webhooks HTML injection...
CVE-2024-22075
Firefly III before 6.1.1 allows HTML Injection via webhooks due to improper sanitization in webhook handling. Affected product: Firefly III (web application). Root cause: inadequate sanitization of webhook inputs leading to HTML injection. Impact: potential exposure/impact limited to confidential...