CVE-2002-1344

CVE-2002-1344 affects wget prior to 1.8.2-4 and is confirmed across multiple disclosures. The vulnerability is a directory-traversal flaw that allows a malicious FTP server to create or overwrite files as the wget user by using filenames containing /absolute/path or .. sequences. Public documenta...

CVE-2004-1487

CVE-2004-1487 affects wget 1.8.x and 1.9.x, where a remote server can cause overwriting of local files via a redirect URL containing ".." that resolves to the attacker’s IP, bypassing wget’s ".." filtering. Connected docs confirm this as a vulnerability in redirection URL handling and indicate up...

CVE-2004-1488

CVE-2004-1488 affects wget 1.8.x and 1.9.x, where control characters in HTTP responses were not filtered/quoted when displayed in the terminal. This allowed remote attackers (malicious web servers) to inject terminal escape sequences that could lead to arbitrary code execution in interactive sess...

CVE-2006-6719

CVE-2006-6719 affects FSF GNU wget 1.10.2; the ftp_syst function in ftp-basic.c can be triggered by a malicious FTP server sending a flood of blank 220 responses to SYST, causing a denial-of-service (application crash). Exploitation is remote via the FTP server. Remediation is to update to patche...

CVE-1999-0402

CVE-1999-0402 affects wget 1.5.3, where the tool follows symlinks and changes permissions of the target file (not the symlink). The Red Hat, SUSE, and PT-Software entries corroborate the same description. The root cause is wget’s behavior when handling symlinks, leading to potential unintended pe...