CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) |
| 04/12/2021 |
| CVE-2021-4015 | 보통4.3 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | 01/12/2021 |
| CVE-2021-3921 | 보통4.3 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | 13/11/2021 |
| CVE-2021-3901 | 높음8.8 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | 27/10/2021 |
| CVE-2021-3900 | 보통6.5 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | 27/10/2021 |
| CVE-2021-3851 | 보통5.4 | firefly-iii is vulnerable to URL Redirection to Untrusted Site | 19/10/2021 |
| CVE-2021-3846 | 높음8.8 | firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type | 19/10/2021 |
| CVE-2021-3819 | 높음8.8 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | 27/09/2021 |
| CVE-2021-3663 | 높음7.5 | firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts | 25/07/2021 |
| CVE-2019-14672 | 보통5.4 | Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field. The JavaScript code is executed upon an error condition during a visit to the account show page. | 05/08/2019 |
| CVE-2019-14671 | 낮음3.3 | Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fints_url to import/job/configuration, and import/create/fints. | 05/08/2019 |
| CVE-2019-14670 | 보통5.4 | Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed during rule-from-bill creation. | 05/08/2019 |
| CVE-2019-14669 | 보통5.4 | Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name. The JavaScript code is executed during a visit to the audit account statistics page. | 05/08/2019 |
| CVE-2019-14668 | 보통5.4 | Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field. The JavaScript code is executed during deletion of a transaction link. | 05/08/2019 |
| CVE-2019-14667 | 보통6.1 | Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name. The JavaScript code is executed during a convert transaction action. | 05/08/2019 |
| CVE-2019-13647 | 보통5.4 | Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/view/$file_id$ attachment viewing. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to e | 18/07/2019 |