CVE-2016-4971

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Jun 30, 2016
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-49729.8OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka)CVE-2016-49737.8Binaries compiled against targets that use the libssp library in GCC for stack smashing protection (SSP) might allow local users to perform CVE-2016-49747.5Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpatCVE-2016-49756.1Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made iCVE-2016-49765.5Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line, which allows local users to obtain sensitiveCVE-2016-49778.8When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_tCVE-2016-49787.2The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in CVE-2016-49797.5The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient requiCVE-2016-49802.5A password generation weakness exists in xquest through 2016-06-13.CVE-2016-49824.7authd sets weak permissions for /etc/ident.key, which allows local users to obtain the key by leveraging a race condition between the creatiCVE-2016-49833.3A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.CVE-2016-49844.7/usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS certificate, which allows local users to
CVE-2016-4971: High severity, CVSS 8.8 | Vulnix