CVE-2014-4877

CriticalCVSS 9.3/10Last modified Jun 17, 2026

Description

Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Oct 29, 2014
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2014

CVE-2014-48807.5Buffer overflow in Hikvision DVR DS-7204 Firmware 2.2.10 build 131009, and other models and versions, allows remote attackers to execute arbCVE-2014-48815.4The PartyTrack library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof seCVE-2014-48827.5Aptexx Resident Anywhere does not require authentication, which allows remote attackers to obtain sensitive information or modify data via aCVE-2014-48834.3resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and sCVE-2014-48845.4The Conrad Hotel (aka com.wConradHotel) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-inCVE-2014-48855.4The CPWORLD Close Protection World (aka com.tapatalk.closeprotectionworldcom) application 3.4.4 for Android does not verify X.509 certificatCVE-2014-48875.4The Joint Radio Blues (aka com.nobexinc.wls_69685189.rc) application 3.2.3 for Android does not verify X.509 certificates from SSL servers, CVE-2014-48885.4The BattleFriends at Sea GOLD (aka com.tequilamobile.warshipslivegold) application 1.1.0 for Android does not verify X.509 certificates fromCVE-2014-48895.4The Diabetic Diet Guide (aka com.wDiabeticDietGuide) application 2.1 for Android does not verify X.509 certificates from SSL servers, which CVE-2014-48905.4The Nano Digest (aka com.magzter.nanodigest) application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows mCVE-2014-48915.4The CT iHub (aka com.concursive.ctihub) application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-tCVE-2014-48925.4The uControl Smart Home Automation (aka de.ucontrol) application 1.2 for Android does not verify X.509 certificates from SSL servers, which
CVE-2014-4877: Critical severity, CVSS 9.3 | Vulnix