Likely to be exploited (10% or more)

Every one of the 42 is a mark on the map. Named now: 1 to 26, most at risk first.

1. A DNS server allows zone transfers.CVE-1999-053269% likely
2. A Windows NT local user or administrator account has a default, null, blank, or missing password.CVE-1999-0504Microsoft · 64% likely

   Microsoft

3. A system is running a version of software that was replaced with a Trojan Horse at one of its distribution points, such as (1) TCP Wrappers 7.6, (2) util-linux 2.9g, (3) wuarchive…CVE-1999-066154% likely
4. A Unix account has a default, null, blank, or missing password.CVE-1999-0502Sun · 53% likely

   Sun Microsystems

5. Sample Internet Data Query (IDQ) scripts in IIS 3 and 4 allow remote attackers to read files via a .. (dot dot) attack.CVE-2000-0126Microsoft · 46% likely

   Microsoft

6. The showcode.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files.CVE-1999-0736Microsoft · 45% likely

   Microsoft

7. Buffer overflow in ProFTPD, wu-ftpd, and beroftpd allows remote attackers to gain root access via a series of MKD and CWD commands that create nested directories.CVE-1999-0911Proftpd Project · 38% likely

   Proftpd

8. Teardrop IP denial of service.CVE-1999-0015Microsoft · 35% likely

   Microsoft

9. Perl, sh, csh, or other shell interpreters are installed in the cgi-bin directory on a WWW site, which allows remote attackers to execute arbitrary commands.CVE-1999-050933% likely

   CWE-94

10. ICMP information such as (1) netmask and (2) timestamp is allowed from arbitrary hosts.CVE-1999-0524Cisco · CVSS 4 · 32% likely

    CWE-200Cisco

11. The codebrws.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files.CVE-1999-0739Microsoft · 29% likely

    Microsoft

12. The code.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files.CVE-1999-0738Microsoft · 29% likely

    Microsoft

13. An SNMP community name is the default (e.g. public), null, or missing.CVE-1999-0517Sun · CVSS 5.9 · 29% likely

    CWE-200Sun Microsystems

14. The viewcode.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files.CVE-1999-0737Microsoft · 28% likely

    Microsoft

15. IIS 4.0 allows a remote attacker to obtain the real pathname of the document root by requesting non-existent files with .ida or .idq extensions.CVE-2000-0071Microsoft · 28% likely

    Microsoft

16. Internet Explorer 5.0 and 5.01 allows remote attackers to bypass the cross frame security policy and read files via the external.NavigateAndFind function.CVE-2000-0028Microsoft · 23% likely

    Microsoft

17. Frontpage Server Extensions allows remote attackers to determine the physical path of a virtual directory via a GET request to the htimage.exe CGI program.CVE-2000-0122Microsoft · 21% likely

    Microsoft

18. Outlook Express 5.01 and Internet Explorer 5.01 allow remote attackers to view a user's email messages via a script that accesses a variable that references subsequent email messa…CVE-2000-0105Microsoft · 21% likely

    Microsoft

19. Buffer overflow in Apache 1.2.5 and earlier allows a remote attacker to cause a denial of service with a large number of GET requests containing a large number of / characters.CVE-1999-0107Apache · 20% likely

    Apache

20. Internet Explorer 5 does not modify the security zone for a document that is being loaded into a window until after the document has been loaded, which could allow remote attacker…CVE-2000-0061Microsoft · 20% likely

    Microsoft

21. Microsoft Java Virtual Machine allows remote attackers to read files via the getSystemResourceAsStream function.CVE-2000-0132Microsoft · 19% likely

    CWE-200Microsoft

22. In IIS, an attacker could determine a real path using a request for a non-existent URL that would be interpreted by Perl (perl.exe).CVE-1999-0450Microsoft · 19% likely

    Microsoft

23. Hotmail does not properly filter JavaScript code from a user's mailbox, which allows a remote attacker to execute the code by using hexadecimal codes to specify the javascript: pr…CVE-2000-0081Microsoft · 19% likely

    Microsoft

24. Internet Explorer 5.0 allows window spoofing, allowing a remote attacker to spoof a legitimate web site and capture information from the client.CVE-1999-0469Microsoft · 18% likely

    Microsoft

25. A Windows NT domain user or administrator account has a default, null, blank, or missing password.CVE-1999-0506Microsoft · 17% likely

    Microsoft

26. Remote attackers can perform a denial of service in Windows machines using malicious ARP packets, forcing a message box display for each packet or filling up log files.CVE-1999-0444Microsoft · 17% likely

    Microsoft

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.