CVE-2004-1604

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

cPanel 9.9.1-RELEASE-3 allows remote authenticated users to chmod arbitrary files via a symlink attack on the _private directory, which is created when Front Page extensions are enabled.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected software

No affected versions have been published.

Timeline

Published
Sep 30, 2004
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2004

CVE-2004-16057.5SalesLogix 6.1 allows remote attackers to bypass authentication by modifying the slxweb cookie to set user=Admin, teams=ADMIN!, and usertypeCVE-2004-16066.4slxweb.dll in SalesLogix 6.1 allows remote attackers to cause a denial service (application crash) via an invalid HTTP request, which might CVE-2004-16075.0slxweb.dll in SalesLogix 6.1 allows remote attackers to obtain sensitive information via a (1) Library or (2) Attachment request with an invCVE-2004-16087.5SQL injection vulnerability in SalesLogix 6.1 allows remote attackers to execute arbitrary SQL statements via the id parameter in a view opeCVE-2004-16095.0SalesLogix 6.1 includes usernames, passwords, and other sensitive information in the headers of an HTTP response, which could allow remote aCVE-2004-16107.5SalesLogix 6.1 uses client-specified pathnames for writing certain files, which might allow remote authenticated users to create arbitrary fCVE-2004-16115.1SalesLogix 6.1 does not verify if a user is authenticated before performing sensitive operations, which could allow remote attackers to (1) CVE-2004-16125.0Directory traversal vulnerability in SalesLogix 6.1 allows remote attackers to upload arbitrary files via a .. (dot dot) in a ProcessQueueFiCVE-2004-16135.0Mozilla allows remote attackers to cause a denial of service (application crash from null dereference or infinite loop) via a web page that CVE-2004-16145.0Mozilla allows remote attackers to cause a denial of service (application crash from invalid memory access) via an "unusual combination of vCVE-2004-16152.6Opera allows remote attackers to cause a denial of service (invalid memory reference and application crash) via a web page or HTML email thaCVE-2004-16165.0Links allows remote attackers to cause a denial of service (memory consumption) via a web page or HTML email that contains a table with a td
CVE-2004-1604: Medium severity, CVSS 5.0 | Vulnix