Wget
by GNU
Source repositories
CVEs (25)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2010-2252 | 0.00 | — | 0.04 | Jul 6, 2010 | GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx… | |||
| CVE-2009-3490 | 0.00 | — | 0.04 | Sep 30, 2009 | GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification… | |||
| CVE-2004-1487 | 0.00 | — | 0.02 | Apr 27, 2005 | wget 1.8.x and 1.9.x allows a remote malicious web server to overwrite certain files via a redirection URL containing a ".." that resolves to the IP address of the malicious server, which bypasses wget's filtering for ".." sequences. | |||
| CVE-2002-1344 | 0.00 | — | 0.04 | Dec 18, 2002 | Directory traversal vulnerability in wget before 1.8.2-4 allows a remote FTP server to create or overwrite files as the wget user via filenames containing (1) /absolute/path or (2) .. (dot dot) sequences. | |||
| CVE-1999-0402 | 0.00 | — | 0.01 | Jan 2, 1999 | wget 1.5.3 follows symlinks to change permissions of the target file instead of the symlink itself. |
- CVE-2010-2252Jul 6, 2010risk 0.00cvss —epss 0.04
GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx…
- CVE-2009-3490Sep 30, 2009risk 0.00cvss —epss 0.04
GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification…
- CVE-2004-1487Apr 27, 2005risk 0.00cvss —epss 0.02
wget 1.8.x and 1.9.x allows a remote malicious web server to overwrite certain files via a redirection URL containing a ".." that resolves to the IP address of the malicious server, which bypasses wget's filtering for ".." sequences.
- CVE-2002-1344Dec 18, 2002risk 0.00cvss —epss 0.04
Directory traversal vulnerability in wget before 1.8.2-4 allows a remote FTP server to create or overwrite files as the wget user via filenames containing (1) /absolute/path or (2) .. (dot dot) sequences.
- CVE-1999-0402Jan 2, 1999risk 0.00cvss —epss 0.01
wget 1.5.3 follows symlinks to change permissions of the target file instead of the symlink itself.
Page 2 of 2