MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• mfscripts yetishare3.5.2 and later · up to 4.5.4 inclusive

Other highest-scoring records for the same primary product.

• CVE-2019-20062MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a leaked hash (the hash never expires until u
  39Monitor
• CVE-2019-19735class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes (based only on micro
  36Monitor
• CVE-2019-20059payment_manage.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.4 directly insert values from the sSortDir_0
  35Monitor
• CVE-2019-19737MFScripts YetiShare 3.5.2 through 4.5.3 does not set the SameSite flag on session cookies, allowing the cookie to be sent in cross-site requ
  35Monitor
• CVE-2019-19734_account_move_file_in_folder.ajax.php in MFScripts YetiShare 3.5.2 directly inserts values from the fileIds parameter into a SQL string.
  35Monitor
• CVE-2019-20061The user-introduction email in MFScripts YetiShare v3.5.2 through v4.5.4 may leak the (system-picked) password if this email is sent in clea
  30Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.