EUVD-2004-0528

Malware in sbrugna...

CVE-2004-0490

cPanel, when compiling Apache 1.3.29 and PHP with the modphpsuexec option, does not set the --enable-discard-path option, which causes php to use the SCRIPTFILENAME variable to find and execute a script instead of the PATHTRANSLATED variable, which allows local users to execute arbitrary PHP code...

CVE-2004-0490

CVE-2004-0490 affects cPanel when compiling Apache 1.3.29 with mod_phpsuexec; it does not set --enable-discard-path, so PHP uses SCRIPT_FILENAME instead of PATH_TRANSLATED, enabling local users to run the attacker’s script with the user’s privileges. This is a local vulnerability with complete co...