CVE-2004-1769

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to resetpass.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=107904890724201&w=2
http://secunia.com/advisories/11111Vendor Advisory
http://www.kb.cert.org/vuls/id/831534Third Party Advisory, US Government Resource
http://www.securityfocus.com/archive/1/357064/2004-03-08/2004-03-14/0Vendor Advisory
http://www.securityfocus.com/bid/9848Exploit, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15443
http://marc.info/?l=bugtraq&m=107904890724201&w=2
http://secunia.com/advisories/11111Vendor Advisory
http://www.kb.cert.org/vuls/id/831534Third Party Advisory, US Government Resource
http://www.securityfocus.com/archive/1/357064/2004-03-08/2004-03-14/0Vendor Advisory
http://www.securityfocus.com/bid/9848Exploit, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15443

Timeline

Published: Mar 11, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-177010.0The login page for cPanel 9.1.0, and possibly other versions, allows remote attackers to execute arbitrary code via shell metacharacters in CVE-2004-17715.0Scalable OGo (SOGo) 1.0 allows remote authenticated users to bypass intended permissions and view private appointments of other users.CVE-2004-17724.6Stack-based buffer overflow in shar in GNU sharutils 4.2.1 allows local users to execute arbitrary code via a long -o command line argument.CVE-2004-17737.5Multiple buffer overflows in sharutils 4.2.1 and earlier may allow attackers to execute arbitrary code via (1) long output from wc to shar, CVE-2004-17747.2Buffer overflow in the SDO_CODE_SIZE procedure of the MD2 package (MDSYS.MD2.SDO_CODE_SIZE) in Oracle 10g before 10.1.0.2 Patch 2 allows loc CVE-2004-17755.0Cisco VACM (View-based Access Control MIB) for Catalyst Operating Software (CatOS) 5.5 and 6.1 and IOS 12.0 and 12.1 allows remote attackers CVE-2004-17767.5Cisco IOS 12.1(3) and 12.1(3)T allows remote attackers to read and modify device configuration data via the cable-docsis read-write communit CVE-2004-17775.0A "range check error" in Skype for Windows before 0.98.0.28 allows local and remote attackers to cause a denial of service (application cras CVE-2004-17784.6Skype 0.92.0.12 and 1.0.0.1 for Linux, and possibly other versions, creates the /usr/share/skype/lang directory with world-writable permissi CVE-2004-17794.3Cross-site scripting (XSS) vulnerability in board.php for ThWboard before beta 2.84 allows remote attackers to inject arbitrary web script o CVE-2004-17804.6Info Touch Surfnet kiosk allows local users to deposit extra time into Internet kiosk accounts via repeated authentication attempts.CVE-2004-17814.6Info Touch Surfnet kiosk allows local users to crash Surfnet and access the underlying operating system via the CMD_CREDITCARD_CHARGE comman