CVE-2019-19732

The CVE-2019-19732 entry affects MFScripts YetiShare versions 3.5.2 through 4.5.3 (and related revisions noted in connected records). The underlying issue is direct insertion of values from the aSortDir_0 and/or sSortDir_0 parameters into a SQL string in translation_manage_text.ajax.php and multi...

CVE-2019-20061

The CVE describes a vulnerability in MFScripts YetiShare (versions 3.5.2–4.5.4) where the user introduction email may disclose the system-generated initial password if sent in cleartext. Root cause: the initial password is not user-chosen, and sending it in plaintext enables leakage. Impact noted...

CVE-2019-20060

The CVE-2019-20060 issue affects MFScripts YetiShare, specifically versions 3.5.2 through 4.5.4. The root cause is that sensitive information is placed in the Referer header, which can be leaked to third parties. This exposure can reveal password-reset hashes, file-delete links, and other sensiti...

CVE-2019-19739

CVE-2019-19739 affects MFScripts YetiShare versions 3.5.2 through 4.5.3. The root cause is that session cookies are created without the Secure flag, allowing them to be transmitted over cleartext channels. Impact: cookies may be exposed via insecure transport, as reflected in CVSS metrics (CVSS v...