Approved changes feed: RSS · Atom
cpe:2.3:a:mfscripts:yetishare:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Mfscripts (9fd2c383-a847-5e96-9fa1-8f3781007b33) |
|---|---|
| Product | Yetishare (82c6f65e-5e4d-5087-a1f4-f39090aeeaf5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2019-20062 |
vulnerable | 2026-06-08 05:13:30.452934 |
Details available
MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a leaked hash (the hash never expires until used).
Published: 2020-02-10T12:17:55.000Z
Updated: 2024-08-05T02:32:10.514Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-20061 |
vulnerable | 2026-06-08 05:13:30.452618 |
Details available
The user-introduction email in MFScripts YetiShare v3.5.2 through v4.5.4 may leak the (system-picked) password if this email is sent in cleartext. In other words, the user is not allowed to choose their own initial password.
Published: 2020-02-10T12:19:34.000Z
Updated: 2024-08-05T02:32:10.507Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-20060 |
vulnerable | 2026-06-08 05:13:30.452183 |
Details available
MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header. If this leaks, then third parties may discover password-reset hashes, file-delete links, or other sensitive information.
Published: 2020-02-10T12:20:50.000Z
Updated: 2024-08-05T02:32:10.511Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-20059 |
vulnerable | 2026-06-08 05:13:30.451735 |
Details available
payment_manage.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.4 directly insert values from the sSortDir_0 parameter into a SQL string. This allows an attacker to inject their own SQL and manipulate the query, typically extracting data from the database, aka SQL Injection. NOTE: this issue exists because of an incomplete fix for CVE-2019-19732.
Published: 2020-02-10T12:13:57.000Z
Updated: 2024-08-05T02:32:10.520Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-19806 |
vulnerable | 2026-06-08 05:13:23.768878 |
Details available
_account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 displays a message indicating whether an email address is configured for the account name provided. This can be used by an attacker to enumerate accounts by guessing email addresses.
Published: 2019-12-30T17:07:08.000Z
Updated: 2024-08-05T02:25:12.673Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-19805 |
vulnerable | 2026-06-08 05:13:23.768586 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-19739 |
vulnerable | 2026-06-08 05:13:23.509354 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-19738 |
vulnerable | 2026-06-08 05:13:23.509002 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-19737 |
vulnerable | 2026-06-08 05:13:23.508716 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-19736 |
vulnerable | 2026-06-08 05:13:23.508438 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-19735 |
vulnerable | 2026-06-08 05:13:23.508160 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-19734 |
vulnerable | 2026-06-08 05:13:23.507852 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-19733 |
vulnerable | 2026-06-08 05:13:23.507430 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-19732 |
vulnerable | 2026-06-08 05:13:23.506906 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.