Input Validation and Logic

Every one of the 42 is a mark on the map. Named now: 1 to 26, most at risk first.

1. GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.CVE-2018-0494Gnu · 16% likely

   CWE-20

2. The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize the random value for the pointer gu…CVE-2013-4788Gnu · 11% likely

   CWE-20

3. Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc or libc6) allows remote attackers to cause a denial of servi…CVE-2016-3706Gnu · 5.9% likely

   CWE-20

4. GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution.…CVE-2018-1000156Gnu · 5.3% likely

   CWE-20

5. The demangler in GNU Libiberty allows remote attackers to cause a denial of service (infinite loop, stack overflow, and crash) via a cycle in the references of remembered mangled…CVE-2016-6131Gnu · 4.6% likely

   CWE-20

6. GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or…CVE-2010-2252Gnu · 4.2% likely

   CWE-20

7. The huft_build function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman) table that is too small, which allows remote attackers to cause a denial of service (appli…CVE-2009-2624Gnu · 4.2% likely

   CWE-20

8. The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the…CVE-2016-10228Gnu · 4.1% likely

   CWE-20

9. The _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service (buffer over-read and crash) via a crafted…CVE-2013-2116Gnu · 3.8% likely

   CWE-20

10. iconvdata/ibm930.c in GNU C Library (aka glibc) before 2.16 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a multibyte character value of…CVE-2012-6656Gnu · 3.4% likely

    CWE-20

11. GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances…CVE-2019-12290Gnu · 3.2% likely

    CWE-20

12. An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site.CVE-2018-13796Gnu · 2.5% likely

    CWE-20

13. The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that has an off-by-one vulnerabili…CVE-2017-7301Gnu · 2.4% likely

    CWE-20

14. In the coff_pointerize_aux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, an index is not validated, which al…CVE-2018-7208Gnu · 2.2% likely

    CWE-20

15. The "GNUTLS_KEYLOGFILE" environment variable in gnutls 3.4.12 allows remote attackers to overwrite and corrupt arbitrary files in the filesystem.CVE-2016-4456Gnu · 2.2% likely

    CWE-20

16. readelf.c in GNU Binutils 2017-04-12 has a "shift exponent too large for type unsigned long" issue, which might allow remote attackers to cause a denial of service (application cr…CVE-2017-9043Gnu · 2.1% likely

    CWE-20

17. The bfd_get_debug_link_info_1 function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, has an unchecked strnlen operatio…CVE-2018-6759Gnu · 2.1% likely

    CWE-20

18. The bfd_section_from_shdr function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denia…CVE-2018-8945Gnu · 2.0% likely

    CWE-20

19. The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 because the existing reloc offset range test…CVE-2017-8396Gnu · 1.8% likely

    CWE-20

20. A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with priv…CVE-2020-14372Gnu · 1.7% likely

    CWE-184

21. There is an assertion abort in the function parse_attributes() in data/sys-file-reader.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to remote denial of service.CVE-2017-12961Gnu · 1.3% likely

    CWE-20

22. The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LS_OPTIONS, which allows loc…CVE-2010-0002Gnu · 0.7% likely

    CWE-20

23. url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the…CVE-2024-38428Gnu · CVSS 9.1 · 0.7% likely

    CWE-436

24. GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue…CVE-2026-108976GNU · CVSS 7.8 · 0.6% likely

    CWE-184

25. The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrate…CVE-2014-7817Gnu · 0.6% likely

    CWE-20

26. Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables.CVE-2016-7543Gnu · 0.6% likely

    CWE-20

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.