Stackstorm

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. In st2web in StackStorm Web UI before 2.9.3 and 2.10.x before 2.10.3, it is possible to bypass the CORS protection mechanism via a "null" origin value, potentially leading to XSS.CVE-2019-9580Stackstorm · 3.0% likely

   CWE-79

2. In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja does not enable sandboxed mode…CVE-2021-44657Stackstorm · 2.6% likely
3. StackStorm before 3.4.1, in some situations, has an infinite loop that consumes all available memory and disk space. This can occur if Python 3.x is used, the locale is not utf-8,…CVE-2021-28667Stackstorm · 2.5% likely

   CWE-835

4. Incorrect access control in StackStorm API (st2api) in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker (who has a StackStorm account and is authenticated again…CVE-2018-20345Stackstorm · 0.7% likely
5. Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to access K/V pairs of other users, potenti…CVE-2022-44009Stackstorm · CVSS 7.5 · 0.7% likely

   CWE-862

6. Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pack rules to inject arbitrary script or…CVE-2022-43706Stackstorm · CVSS 5.4 · 0.4% likely

   CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.