Vulnerabilities

TI-2024-14686 CVE-2024-22075 · GHSA-vwv2-9wcj-64vx

Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.

LOW 27

Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00348 Published 2024-01-05 Fixed in 6.1.1 CWE-79

TI-2023-01680 CVE-2023-1788 · GHSA-h7vv-46p5-prmh

Insufficient Session Expiration in firefly-iii/firefly-iii

HIGH 75

Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00438 Published 2023-04-05 Fixed in 6, 6.0.0 CWE-613

TI-2023-01681 CVE-2023-1789 · GHSA-mwxw-hxvp-4r2r

Improper Input Validation in firefly-iii/firefly-iii

HIGH 75

Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00335 Published 2023-04-01 Fixed in 6.0.0 CWE-20

TI-2023-00283 CVE-2023-0298 · GHSA-7mc4-jp4f-v2j2

Incorrect Authorization in firefly-iii/firefly-iii

MEDIUM 62

Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00643 Published 2023-01-14 Fixed in 5.8.0 CWE-863

TI-2021-02900 CVE-2021-4005 · GHSA-hjhp-hwfj-hwf3

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

LOW 20

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00443 Published 2021-12-04 Fixed in 5.6.6, 5.6.5 CWE-352

TI-2021-02906 CVE-2021-4015 · GHSA-g6vq-wc8w-4g69

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

LOW 20

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00443 Published 2021-12-01 Fixed in 5.6.4, 5.6.5 CWE-352

TI-2021-02830 CVE-2021-3921 · GHSA-q2cv-94xm-qvg4

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

LOW 20

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00443 Published 2021-11-13 Fixed in 5.6.3 CWE-352

TI-2021-02811 CVE-2021-3901 · GHSA-rqgp-ccph-5w65

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

LOW 39

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00554 Published 2021-10-27 No fix listed CWE-352

TI-2021-02810 CVE-2021-3900 · GHSA-pfj7-w373-gqch

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

LOW 30

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00551 Published 2021-10-27 No fix listed CWE-352

TI-2021-02782 CVE-2021-3851 · GHSA-5fvx-5p2r-4mvp

Open Redirect in firefly-iii/firefly-iii

LOW 25

firefly-iii is vulnerable to URL Redirection to Untrusted Site

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00571 Published 2021-10-19 Fixed in 5.6.2 CWE-601

TI-2021-02777 CVE-2021-3846 · GHSA-5gq7-826w-8282

Unrestricted Upload of File with Dangerous Type in firefly-iii/firefly-iii

LOW 39

firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00779 Published 2021-10-19 Fixed in 5.6.2 CWE-434

TI-2021-02750 CVE-2021-3819 · GHSA-356r-77q8-f64f

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

LOW 39

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00541 Published 2021-09-27 Fixed in 5.6.1 CWE-352

TI-2021-02663 CVE-2021-3730 · GHSA-c676-mcw3-qg55

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

LOW 29

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00475 Published 2021-08-23 Fixed in 5.6.0 CWE-352

TI-2021-02662 CVE-2021-3729 · GHSA-gp6w-ccqv-p7qr

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

LOW 20

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00405 Published 2021-08-23 Fixed in 5.6.0 CWE-352

TI-2021-02661 CVE-2021-3728 · GHSA-xp5q-77mh-6hm2

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

LOW 29

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00501 Published 2021-08-23 Fixed in 5.6.0 CWE-352

TI-2021-02605 CVE-2021-3663 · GHSA-56cx-wf47-hx7w

Improper Restriction of Excessive Authentication Attempts in firefly-iii/firefly-iii

LOW 34

firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0071 Published 2021-07-25 Fixed in 5.5.13 CWE-307

TI-2019-10895 CVE-2019-14667 · GHSA-cc63-hf4q-596r

Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of…

LOW 30

Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01327 Published 2019-08-05 No fix listed CWE-79

TI-2019-10896 CVE-2019-14668 · GHSA-8r9r-6f5g-px79

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of…

LOW 26

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00762 Published 2019-08-05 No fix listed CWE-79

TI-2019-10897 CVE-2019-14669 · GHSA-84p6-3h2w-fwrg

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of…

LOW 26

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00762 Published 2019-08-05 No fix listed CWE-79

TI-2019-10898 CVE-2019-14670 · GHSA-qr4w-v4fh-wx86

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of…

LOW 26

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00762 Published 2019-08-05 No fix listed CWE-79

TI-2019-10899 CVE-2019-14671 · GHSA-jjcx-999m-35hc

Firefly III 4.7.17.3 is vulnerable to local file enumeration.

LOW 16

Firefly III 4.7.17.3 is vulnerable to local file enumeration.

CVSS 3.0LOW 3.3 Local Low privileges No interaction EPSS 0.00472 Published 2019-08-05 Fixed in 4.7.17.4 CWE-20

TI-2019-10900 CVE-2019-14672 · GHSA-qc5c-m97j-wqw3

Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of…

LOW 26

Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00744 Published 2019-08-05 No fix listed CWE-79

TI-2019-10254 CVE-2019-13647 · GHSA-pcxq-28f6-m3fm

Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of…

LOW 26

Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00748 Published 2019-07-18 Fixed in 4.7.17.3 CWE-79

TI-2019-10253 CVE-2019-13646 · GHSA-mrc2-h7q2-pp97

Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of…

LOW 26

Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00748 Published 2019-07-18 Fixed in 4.7.17.3 CWE-79

TI-2019-10252 CVE-2019-13645 · GHSA-5hpw-vcj2-prwg

Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of…

LOW 26

Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00748 Published 2019-07-18 Fixed in 4.7.17.3 CWE-79

Vulnerabilities

Filters