CVE-2019-19738

The CVE-2019-19738 entry applies to Mellow Fish YetiShare (MFScripts) 3.5.2 through 4.5.3. The root cause is that log_file_viewer.php does not sanitize or encode the output from the lFile parameter, allowing an attacker to inject HTML or scripts (XSS) on the page. The connected Red Hat and CNVD r...

CVE-2019-19732

The CVE-2019-19732 entry affects MFScripts YetiShare versions 3.5.2 through 4.5.3 (and related revisions noted in connected records). The underlying issue is direct insertion of values from the aSortDir_0 and/or sSortDir_0 parameters into a SQL string in translation_manage_text.ajax.php and multi...

CVE-2019-19734

CVE-2019-19734 affects MFScripts YetiShare 3.5.2 where _account_move_file_in_folder.ajax.php directly inserts values from the fileIds parameter into a SQL string, enabling SQL injection. Root cause is lack of proper input validation/parameterization, leading to manipulation of queries and potenti...

CVE-2019-19733

CVE-2019-19733 affects MFScripts YetiShare, version range 3.5.2 through 4.5.3. The vulnerability lies in the file get_all_file_server_paths.ajax.php where output derived from the client-supplied fileIds parameter is not sanitized/encoded, enabling an attacker to inject HTML or script code on the ...

CVE-2019-19806

The CVE-2019-19806 issue affects MFScripts YetiShare versions 3.5.2 through 4.5.3, where _account_forgot_password.ajax.php reveals whether an email address is configured for a given account name. This enables attacker-driven account enumeration via guessing email addresses. The connected document...

CVE-2019-19735

The CVE-2019-19735 issue affects Mellow Fish YetiShare (MFScripts YetiShare) versions 3.5.2–4.5.3, specifically in class.userpeer.php. The root cause is an insecure method for generating password reset hashes based solely on microtime, enabling an attacker to brute-force the hash and set a passwo...

CVE-2019-19736

CVE-2019-19736 concerns MFScripts YetiShare 3.5.2–4.5.3 where session cookies lack the HttpOnly flag, enabling potential script access and cookie theft via cross-site scripting. Affected component: server-side session handling in YetiShare; root cause: absence of HttpOnly on cookies. Impact: risk...

CVE-2019-19805

Affected software: MFScripts YetiShare, versions 3.5.2 through 4.5.3. The vulnerability stems from a timing discrepancy in _account_forgot_password.ajax.php that reveals whether an email address is configured for a given account name, enabling an attacker to enumerate valid accounts by guessing e...

CVE-2019-19737

CVE-2019-19737 affects MFScripts YetiShare in versions 3.5.2 through 4.5.3. The root cause is that session cookies do not have the SameSite flag set, allowing cookies to be sent with cross-site requests and potentially enabling cross-site request forgery attacks. Multiple connected sources confir...

CVE-2019-19739

CVE-2019-19739 affects MFScripts YetiShare versions 3.5.2 through 4.5.3. The root cause is that session cookies are created without the Secure flag, allowing them to be transmitted over cleartext channels. Impact: cookies may be exposed via insecure transport, as reflected in CVSS metrics (CVSS v...