Approved changes feed: RSS · Atom
cpe:2.3:a:gnu:wget:-:*:*:*:*:*:*:*
part: a version: - update: *
| Vendor | Gnu (575dd98a-a14a-5d9e-a2eb-97d38d86fcb9) |
|---|---|
| Product | Wget (a0d3e482-fa38-5dbf-b784-c8c904278a1d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/wget |
purl2cpe | 2026-06-01 10:11:54.136428 |
pkg:deb/ubuntu/wget |
purl2cpe | 2026-06-01 10:11:54.136431 |
pkg:github/darnir/wget |
purl2cpe | 2026-06-01 10:11:54.136433 |
pkg:github/gitgnu/gnu_wget |
purl2cpe | 2026-06-01 10:11:54.136436 |
pkg:github/val-verde/wget |
purl2cpe | 2026-06-01 10:11:54.136439 |
pkg:gitlab/redhat/wget |
purl2cpe | 2026-06-01 10:11:54.136441 |
pkg:gnu/wget |
purl2cpe | 2026-06-01 10:11:54.136444 |
pkg:rpm/centos/wget |
purl2cpe | 2026-06-01 10:11:54.136447 |
pkg:rpm/fedora/wget |
purl2cpe | 2026-06-01 10:11:54.136449 |
pkg:rpm/opensuse/wget |
purl2cpe | 2026-06-01 10:11:54.136452 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-38428 |
vulnerable | 2026-06-08 06:41:47.141852 |
Details available
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.
Published: 2024-06-16T00:00:00.000Z
Updated: 2025-04-21T10:03:18.212Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-10524 |
vulnerable | 2026-06-08 06:23:46.860775 |
GNU Wget is vulnerable to an SSRF attack when accessing partially-user-controlled shorthand URLs
MEDIUM (6.5)
Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.
Published: 2024-11-19T14:23:09.718Z
Updated: 2025-03-21T18:03:44.339Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.