CVE-2019-14667

Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name. The JavaScript code is executed during a convert transaction action...

CVE-2019-14667

Firefly III 4.7.17.4 is affected by multiple stored XSS issues due to insufficient filtering of user-supplied data in the transaction description field and in the asset account name. The JavaScript payload can execute during a convert transaction action. Affected component: the web interface of F...

CVE-2019-14668

Firefly III 4.7.17.3 is affected by a stored XSS in the transaction description field. The root cause is lack of filtration/sanitization of user-supplied data, allowing JavaScript execution when a transaction link is deleted. Connected sources corroborate a stored XSS in the delete workflow via l...

CVE-2019-14668

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field. The JavaScript code is executed during deletion of a transaction link...

CVE-2019-14669

CVE-2019-14669 affects Firefly III 4.7.17.3 and is a stored XSS vulnerability caused by lack of filtration of user-supplied data in the asset account name. The JavaScript executes when visiting the audit account statistics page. CVSS metrics indicate CVSS‑3.0 base score 5.4 (Medium) with network ...

CVE-2019-14669

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name. The JavaScript code is executed during a visit to the audit account statistics page...

CVE-2019-14670

Firefly III 4.7.17.3 is reported vulnerable to stored XSS stemming from lack of filtration of user-supplied data in the bill name field. The JavaScript payload executes during rule-from-bill creation, indicating a stored XSS flaw. No explicit remediation or patch details are provided in the conne...

CVE-2019-14670

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed during rule-from-bill creation...

CVE-2019-14671

Firefly III 4.7.17.3 is vulnerable to local file enumeration due to insufficient sanitization of protocol schemes, notably file:/// URLs, related to the fints_url used in import/job/configuration and import/create/fints. This affects the ability of an attacker to enumerate local files. The connec...

CVE-2019-14671

Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fintsurl to import/job/configuration, and import/create/fints...

CVE-2019-14672

Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field. The JavaScript code is executed upon an error condition during a visit to the account show page...

CVE-2019-14672

Firefly III 4.7.17.5 is vulnerable to a stored XSS due to lack of filtration of user-supplied data in the liability name field. The JavaScript executes upon an error condition during visits to the account show page. Root cause: unsanitized input in the liability name. Impact: stored XSS; no expli...

Firefly III Cross-Site Scripting Vulnerability (CNVD-2019-30777)

Firefly III is an open source personal financial management system. A cross-site scripting vulnerability exists in Firefly III versions prior to 4.7.17.1, which can be exploited by an attacker to execute client-side code...

Firefly III Cross-Site Scripting Vulnerability (CNVD-2019-30778)

Firefly III is an open source personal financial management system. A cross-site scripting vulnerability exists in Firefly III versions prior to 4.7.17.3, which can be exploited by an attacker to execute client-side code...

Firefly III Cross-Site Scripting Vulnerability (CNVD-2019-30775)

Firefly III is an open source personal financial management system. A cross-site scripting vulnerability exists in Firefly III versions prior to 4.7.17.3, which can be exploited by an attacker to execute client-side code...

Firefly III Cross-Site Scripting Vulnerability (CNVD-2019-30779)

Firefly III is an open source personal financial management system. A cross-site scripting vulnerability exists in Firefly III versions prior to 4.7.17.3, which can be exploited by an attacker to execute client-side code...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack exists because it does not validate the file content provided by the user, allowing an attacker to inject a malicious script through it to get executed during viewing of attachments/view/$fileid$ attachment...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS attacks. The attack is due to lack of sanitization of query string provided by the user in the search query, allowing an attacker to inject a malicious script...

CVE-2019-13646

Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability...

CVE-2019-13644

Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name. The JavaScript code is contained in a transaction, and is executed on the tags/show/$tagnumber$ tag summary page. NOTE: It is asserted that an attacker must have the same acce...