PatchTheCVEmfscripts vulnerabilities
Recent CVEs affecting mfscripts products. 14 tracked.
mfscripts has 14 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 14. Most recent: 2020-02-10. Highest priority: CVE-2019-20062 (score 58/100).
- CVE-2019-20062 CRITICAL 9.8 UPGRADE MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a leaked hash (
- CVE-2019-20061 HIGH 7.5 UPGRADE The user-introduction email in MFScripts YetiShare v3.5.2 through v4.5.4 may leak the (system-picked) password
- CVE-2019-20060 HIGH 7.5 UPGRADE MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header
- CVE-2019-20059 HIGH 8.8 UPGRADE payment_manage.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.4 directly inse
- CVE-2019-19806 MEDIUM 5.3 UPGRADE _account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 displays a message indicating whe
- CVE-2019-19805 MEDIUM 5.3 UPGRADE _account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 takes a different amount of time
- CVE-2019-19739 HIGH 7.5 UPGRADE MFScripts YetiShare 3.5.2 through 4.5.3 does not set the Secure flag on session cookies, allowing the cookie t
- CVE-2019-19738 MEDIUM 6.1 UPGRADE log_file_viewer.php in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output from the
- CVE-2019-19737 HIGH 8.8 UPGRADE MFScripts YetiShare 3.5.2 through 4.5.3 does not set the SameSite flag on session cookies, allowing the cookie
- CVE-2019-19736 MEDIUM 6.1 UPGRADE MFScripts YetiShare 3.5.2 through 4.5.3 does not set the HttpOnly flag on session cookies, allowing the cookie
- CVE-2019-19735 CRITICAL 9.1 UPGRADE class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password res
- CVE-2019-19734 HIGH 8.8 UPGRADE _account_move_file_in_folder.ajax.php in MFScripts YetiShare 3.5.2 directly inserts values from the fileIds pa
- CVE-2019-19733 MEDIUM 6.1 UPGRADE _get_all_file_server_paths.ajax.php (aka get_all_file_server_paths.ajax.php) in MFScripts YetiShare 3.5.2 thro
- CVE-2019-19732 HIGH 7.2 UPGRADE translation_manage_text.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 dire
FAQ
How do I fix mfscripts vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is mfscripts being exploited right now?
None of the tracked mfscripts CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which mfscripts CVE should I patch first?
CVE-2019-20062 currently ranks highest (58/100): MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a leaked hash (.