Input Validation and Logic

Every one of the 5 is a mark on the map. Named now: 1 to 5, most at risk first.

1. Request controller allows to create requests with arbitrary request IDsCVE-2018-12479openSUSE · CVSS 6.5 · 1.7% likely

   CWE-20

2. zypp-refresh-patches in zypper in SUSE openSUSE 10.2, 10.3, and 11.0 does not ask the user before accepting repository keys, which allows remote repositories to cause a denial of…CVE-2008-3187Opensuse · 1.7% likely

   CWE-20

3. obs-service-replace_using_package_version allows to specify arbitrary input filesCVE-2018-12478openSUSE · CVSS 4.8 · 1.5% likely

   CWE-20

4. Crafted service parameters allows to induce unexpected behaviour in obs-service-tar_scmCVE-2018-12474openSUSE · CVSS 5.4 · 1.4% likely

   CWE-20

5. login-proxy sends password to attacker-provided domainCVE-2021-36777openSUSE · CVSS 8.1 · 0.9% likely

   CWE-807

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.