Packagist (Composer) package
grumpydictator/firefly-iii
pkg:composer/grumpydictator/firefly-iii
Vulnerabilities (22)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-37893 | Med | 5.9 | < 6.1.17 | 6.1.17 | Jun 17, 2024 | Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to Firefly III data using passwo | |
| CVE-2024-22075 | — | < 6.1.1 | 6.1.1 | Jan 5, 2024 | Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection. | ||
| CVE-2023-1788 | — | < 6.0.0 | 6.0.0 | Apr 5, 2023 | Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6. | ||
| CVE-2023-1789 | — | < 6.0.0 | 6.0.0 | Apr 1, 2023 | Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0. | ||
| CVE-2023-0298 | — | < 5.8.0 | 5.8.0 | Jan 14, 2023 | Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0. | ||
| CVE-2021-4005 | — | < 5.6.5 | 5.6.5 | Dec 4, 2021 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | ||
| CVE-2021-4015 | — | < 5.6.5 | 5.6.5 | Dec 1, 2021 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | ||
| CVE-2021-3921 | — | < 5.6.3 | 5.6.3 | Nov 13, 2021 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | ||
| CVE-2021-3901 | — | <= 5.6.2 | — | Oct 27, 2021 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | ||
| CVE-2021-3900 | — | <= 5.6.2 | — | Oct 27, 2021 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | ||
| CVE-2021-3851 | — | < 5.6.2 | 5.6.2 | Oct 19, 2021 | firefly-iii is vulnerable to URL Redirection to Untrusted Site | ||
| CVE-2021-3846 | — | < 5.6.2 | 5.6.2 | Oct 19, 2021 | firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type | ||
| CVE-2021-3819 | — | < 5.6.1 | 5.6.1 | Sep 27, 2021 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | ||
| CVE-2021-3730 | — | < 5.6.0 | 5.6.0 | Aug 23, 2021 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | ||
| CVE-2021-3729 | — | < 5.6.0 | 5.6.0 | Aug 23, 2021 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | ||
| CVE-2021-3728 | — | < 5.6.0 | 5.6.0 | Aug 23, 2021 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | ||
| CVE-2021-3663 | — | < 5.5.13 | 5.5.13 | Jul 25, 2021 | firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts | ||
| CVE-2019-14671 | — | < 4.7.17.4 | 4.7.17.4 | Aug 5, 2019 | Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fints_url to import/job/configuration, and import/create/fints. | ||
| CVE-2019-13647 | — | < 4.7.17.3 | 4.7.17.3 | Jul 18, 2019 | Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/view/$file_id$ attachment viewing. NOTE: It is asserted that an attacker must have the same access rig | ||
| CVE-2019-13646 | — | < 4.7.17.3 | 4.7.17.3 | Jul 18, 2019 | Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability |
- affected < 6.1.17fixed 6.1.17
Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to Firefly III data using passwo
- CVE-2024-22075Jan 5, 2024affected < 6.1.1fixed 6.1.1
Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.
- CVE-2023-1788Apr 5, 2023affected < 6.0.0fixed 6.0.0
Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.
- CVE-2023-1789Apr 1, 2023affected < 6.0.0fixed 6.0.0
Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.
- CVE-2023-0298Jan 14, 2023affected < 5.8.0fixed 5.8.0
Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.
- CVE-2021-4005Dec 4, 2021affected < 5.6.5fixed 5.6.5
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
- CVE-2021-4015Dec 1, 2021affected < 5.6.5fixed 5.6.5
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
- CVE-2021-3921Nov 13, 2021affected < 5.6.3fixed 5.6.3
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
- CVE-2021-3901Oct 27, 2021affected <= 5.6.2
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
- CVE-2021-3900Oct 27, 2021affected <= 5.6.2
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
- CVE-2021-3851Oct 19, 2021affected < 5.6.2fixed 5.6.2
firefly-iii is vulnerable to URL Redirection to Untrusted Site
- CVE-2021-3846Oct 19, 2021affected < 5.6.2fixed 5.6.2
firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type
- CVE-2021-3819Sep 27, 2021affected < 5.6.1fixed 5.6.1
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
- CVE-2021-3730Aug 23, 2021affected < 5.6.0fixed 5.6.0
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
- CVE-2021-3729Aug 23, 2021affected < 5.6.0fixed 5.6.0
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
- CVE-2021-3728Aug 23, 2021affected < 5.6.0fixed 5.6.0
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
- CVE-2021-3663Jul 25, 2021affected < 5.5.13fixed 5.5.13
firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts
- CVE-2019-14671Aug 5, 2019affected < 4.7.17.4fixed 4.7.17.4
Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fints_url to import/job/configuration, and import/create/fints.
- CVE-2019-13647Jul 18, 2019affected < 4.7.17.3fixed 4.7.17.3
Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/view/$file_id$ attachment viewing. NOTE: It is asserted that an attacker must have the same access rig
- CVE-2019-13646Jul 18, 2019affected < 4.7.17.3fixed 4.7.17.3
Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability
Page 1 of 2