Possible (1 to 10%)

Every one of the 243 is a mark on the map. Named now: 1 to 26, most at risk first.

1. PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrar…CVE-2001-1246Php · 9.7% likely

   CWE-88PHP

2. The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once (a "double free…CVE-2002-0059Zlib · 9.7% likely

   CWE-415Zlib

3. The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1.0.2.x uses null authentication, which allows remote attackers to gai…CVE-2002-0561Oracle · 9.7% likely

   Oracle

4. Icecast 1.3.7, and other versions before 1.3.11 with HTTP server file streaming support enabled allows remote attackers to cause a denial of service (crash) via a URL that ends in…CVE-2001-1083Icecast · 9.6% likely

   Icecast

5. PHP 4.0.4pl1 and 4.0.5 in safe mode allows remote attackers to read and write files owned by the web server UID by uploading a PHP script that uses the error_log function to acces…CVE-2001-1247Php · 9.4% likely

   CWE-264PHP

6. The default configuration of the DVI print filter (dvips) in Red Hat Linux 7.0 and earlier does not run dvips in secure mode when dvips is executed by lpd, which could allow remot…CVE-2001-1002Redhat · 9.3% likely

   Red Hat

7. Buffer overflow in webpsvc.exe for Talentsoft Web+ 5.0 and earlier allows remote attackers to execute arbitrary code via a long argument to webplus.exe program, which triggers the…CVE-2002-0449Talentsoft · 9.0% likely

   Talentsoft

8. Network Tools 0.2 for PHP-Nuke allows remote attackers to execute commands on the server via shell metacharacters in the $hostinput variable.CVE-2001-0899Phpnuke · 8.9% likely

   Phpnuke

9. Cross-site scripting vulnerability in agora.cgi for Agora 3.0a through 4.0g, when debug mode is enabled, allows remote attackers to execute Javascript on other clients via the car…CVE-2001-1199Steve Kneizys · 8.7% likely
10. Multiple buffer overflows in Melange Chat server 2.02 allow remote or local attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) a long argum…CVE-2002-0552Melange · 8.6% likely
11. Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to cause a denial of service and possibly execute arbitrary code via shar…CVE-2001-1376Ascend · 8.5% likely
12. Directory traversal vulnerability in FileSeek.cgi allows remote attackers to read arbitrary files via a ....// (modified dot dot) in the (1) head or (2) foot parameters, which are…CVE-2002-0611Craig Patchett · 8.3% likely
13. index.php for PHP-Nuke 5.4 and earlier allows remote attackers to determine the physical pathname of the web server when the file parameter is set to index.php, which triggers an…CVE-2002-0483Francisco Burzi · 8.2% likely

    Francisco Burzi

14. Cross-site scripting vulnerability in Citrix NFuse 1.6 and earlier does not quote results from the getLastError method, which allows remote attackers to execute script in other cl…CVE-2002-0504Citrix · 7.9% likely

    Citrix (NetScaler)

15. Directory traversal vulnerability in modules.php in Gallery before 1.2.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the include parameter.CVE-2001-0900Francisco Burzi · 7.9% likely

    Francisco Burzi

16. Web administration interface in CacheFlow CacheOS 4.0.13 and earlier allows remote attackers to obtain sensitive information via a series of GET requests that do not end in with H…CVE-2002-0107Cacheflow · 7.9% likely
17. Jakarta Tomcat 4.0.1 allows remote attackers to reveal physical path information by requesting a long URL with a .JSP extension.CVE-2001-0917Apache · 7.8% likely

    Apache

18. Cross-site scripting vulnerabilities in PostBoard 2.0.1 and earlier allows remote attackers to execute script as other users via (1) an [IMG] tag when BBCode is enabled, or (2) in…CVE-2002-0535Postboard · 7.4% likely
19. PHPNetToolpack 0.1 allows remote attackers to execute arbitrary code via shell metacharacters in the a_query variable.CVE-2002-0471Phpnettoolpack · 7.3% likely
20. The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensiti…CVE-2002-0562Oracle · 7.0% likely

    Oracle

21. Cross-site scripting vulnerability in ReBB allows remote attackers to execute arbitrary Javascript and steal cookies via an IMG tag whose URL includes the malicious script.CVE-2002-0413Rebb · 7.0% likely
22. Buffer overflow in Real Networks RealPlayer 8.0 and earlier allows remote attackers to execute arbitrary code via a header length value that exceeds the actual length of the heade…CVE-2002-0207Realnetworks · 7.0% likely

    Realnetworks

23. PVote before 1.9 allows remote attackers to change the administrative password and gain privileges by directly calling ch_info.php with the newpass and confirm parameters both set…CVE-2002-0589Steve Korbett · 7.0% likely
24. Buffer overflow in index.cgi administration interface for Boozt! Standard 0.9.8 allows local users to execute arbitrary code via a long name field when creating a new banner.CVE-2002-0098Boozt · 6.9% likely

    Boozt

25. webdriver in IBM Informix Web DataBlade 4.12 allows remote attackers to bypass user access levels or read arbitrary files via a SQL injection attack in an HTTP request.CVE-2002-0554Ibm · 6.7% likely

    IBM

26. PVote before 1.9 does not authenticate users for restricted operations, which allows remote attackers to add or delete polls by modifying parameters to (1) add.php or (2) del.php.CVE-2002-0588Steve Korbett · 6.6% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.