Skip to content
Noroxi

firefly-iii records

26 published records for vendor firefly-iii.

Filter by product ↓

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
73.1%
Median publish → KEV
No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 19
  2. 21
  3. 23
  4. 24

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

26 records
  • CVE-2023-1788
    39Monitor

    Insufficient Session Expiration in firefly-iii/firefly-iii

    CriticalCVSS 9.8No exploitEPSS 0%

    firefly-iii · firefly iiiApr 5, 2023

  • CVE-2023-1789
    39Monitor

    Improper Input Validation in firefly-iii/firefly-iii

    CriticalCVSS 9.8No exploitEPSS 0%

    firefly-iii · firefly iiiMar 31, 2023

  • CVE-2021-3846
    35Monitor

    Unrestricted Upload of File with Dangerous Type in firefly-iii/firefly-iii

    HighCVSS 8.8No exploitEPSS 0%

    firefly-iii · firefly iiiOct 19, 2021

  • CVE-2021-3901
    35Monitor

    Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

    HighCVSS 8.8No exploitEPSS 0%

    firefly-iii · firefly iiiOct 27, 2021

  • CVE-2021-3819
    35Monitor

    Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

    HighCVSS 8.8No exploitEPSS 0%

    firefly-iii · firefly iiiSep 27, 2021

  • CVE-2021-3663
    30Monitor

    Improper Restriction of Excessive Authentication Attempts in firefly-iii/firefly-iii

    HighCVSS 7.5No exploitEPSS 0%

    firefly-iii · firefly iiiJul 25, 2021

  • CVE-2023-0298
    26Monitor

    Incorrect Authorization in firefly-iii/firefly-iii

    MediumCVSS 6.5No exploitEPSS 0%

    firefly-iii · firefly iiiJan 14, 2023

  • CVE-2021-3900
    26Monitor

    Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

    MediumCVSS 6.5No exploitEPSS 0%

    firefly-iii · firefly iiiOct 27, 2021

  • CVE-2021-3728
    26Monitor

    Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

    MediumCVSS 6.5No exploitEPSS 0%

    firefly-iii · firefly iiiAug 23, 2021

  • CVE-2021-3730
    26Monitor

    Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

    MediumCVSS 6.5No exploitEPSS 0%

    firefly-iii · firefly iiiAug 23, 2021

  • CVE-2019-14667
    24Monitor

    Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction desc

    MediumCVSS 6.1No exploitEPSS 1%

    firefly-iii · firefly iiiAug 5, 2019

  • CVE-2024-22075
    24Monitor

    Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.

    MediumCVSS 6.1No exploitEPSS 0%

    firefly-iii · firefly iiiJan 4, 2024

  • CVE-2019-14670
    21Monitor

    Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field.

    MediumCVSS 5.4No exploitEPSS 0%

    firefly-iii · firefly iiiAug 5, 2019

  • CVE-2019-14669
    21Monitor

    Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name.

    MediumCVSS 5.4No exploitEPSS 0%

    firefly-iii · firefly iiiAug 5, 2019

  • CVE-2019-14668
    21Monitor

    Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field.

    MediumCVSS 5.4No exploitEPSS 0%

    firefly-iii · firefly iiiAug 5, 2019

  • CVE-2019-13645
    21Monitor

    Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names.

    MediumCVSS 5.4No exploitEPSS 0%

    firefly-iii · firefly iiiJul 17, 2019

  • CVE-2019-13644
    21Monitor

    Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name.

    MediumCVSS 5.4No exploitEPSS 0%

    firefly-iii · firefly iiiJul 17, 2019

  • CVE-2019-13647
    21Monitor

    Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content.

    MediumCVSS 5.4No exploitEPSS 0%

    firefly-iii · firefly iiiJul 17, 2019

  • CVE-2019-13646
    21Monitor

    Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query.

    MediumCVSS 5.4No exploitEPSS 0%

    firefly-iii · firefly iiiJul 17, 2019

  • CVE-2019-14672
    21Monitor

    Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field.

    MediumCVSS 5.4No exploitEPSS 0%

    firefly-iii · firefly iiiAug 5, 2019

  • CVE-2021-3851
    21Monitor

    Open Redirect in firefly-iii/firefly-iii

    MediumCVSS 5.4No exploitEPSS 0%

    firefly-iii · firefly iiiOct 19, 2021

  • CVE-2021-3921
    17Monitor

    Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

    MediumCVSS 4.3No exploitEPSS 0%

    firefly-iii · firefly iiiNov 13, 2021

  • CVE-2021-4005
    17Monitor

    Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

    MediumCVSS 4.3No exploitEPSS 0%

    firefly-iii · firefly iiiDec 4, 2021

  • CVE-2021-4015
    17Monitor

    Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

    MediumCVSS 4.3No exploitEPSS 0%

    firefly-iii · firefly iiiDec 1, 2021

  • CVE-2021-3729
    17Monitor

    Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

    MediumCVSS 4.3No exploitEPSS 0%

    firefly-iii · firefly iiiAug 23, 2021