Externally Controlled Reference to a Resource in Another Sphere

Every one of the 136 is a mark on the map. Named now: 1 to 26, most at risk first.

1. QNAP QTS Photo Station External Reference - Local File InclusionCVE-2022-27593QNAP Systems Inc. · CVSS 10 · 88% likely

   QNAP

2. Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, w…CVE-2017-1835727% likely
3. An elevation of privilege vulnerability exists in Windows 10, Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 versions of Microso…CVE-2017-0211Microsoft Corporation · 14% likely

   Microsoft

4. ThinManager® Code Execution VulnerabilityCVE-2024-45826Rockwell Automation · CVSS 6.8 · 12% likely

   Rockwell Automation

5. Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intendedCVE-2021-26920Apache Software Foundation · 9.5% likely

   Apache

6. Code execution in Apache OpenOffice via non-http(s) schemes in HyperlinksCVE-2021-30245Apache Software Foundation · 4.9% likely

   Apache

7. Externally Controlled Reference to a Resource in Another Sphere in MSEdgeRedirectCVE-2021-43844rcmaehl · CVSS 8.8 · 3.4% likely
8. The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectiv…CVE-2017-16088HackerOne · 3.4% likely

   HackerOne

9. Cross organization admin control in GrafanaCVE-2021-41244grafana · CVSS 9.1 · 2.9% likely

   Grafana

10. Externally controlled reference to a resource in another sphere in quarantine functionality in Synology Antivirus Essential before 1.4.8-2801 allows remote authenticated users to…CVE-2021-27648Synology · CVSS 9 · 2.8% likely

    Synology

11. An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerability. An attacker is able to create new…CVE-2021-271832.7% likely
12. Monsta FTP 2.10.1 or below allows external control of paths used in filesystem operations. This allows attackers to read and write arbitrary local files, allowing an attacker to g…CVE-2020-140572.6% likely
13. Incorrect indirect branch prediction barrier in the Linux KernelCVE-2023-0045Linux · CVSS 4.7 · 2.4% likely

    Linux

14. CI/CD Docker Escape in OneDevCVE-2022-39206theonedev · CVSS 9.9 · 2.2% likely

    Theonedev

15. A frame-injection issue in the online help in Redwood Report2Web 4.3.4.5 allows remote attackers to render an external resource inside a frame via the help/Online_Help/NetHelp/def…CVE-2021-267111.9% likely
16. Manually dragging and dropping an Outlook email message into the browser will trigger a page navigation when the message's mail columns are incorrectly interpreted as a URL. *Note…CVE-2018-12381Mozilla · 1.8% likely

    Mozilla

17. Anonymous cache poisoning via XHR requests in DiscourseCVE-2024-47773discourse · CVSS 8.2 · 1.8% likely

    Discourse

18. UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget argument of the URI handler for uipath-assistant://. This al…CVE-2021-440411.8% likely
19. The PSFTPd 10.0.4 Build 729 server does not prevent FTP bounce scans by default. These can be performed using "nmap -b" and allow performing scans via the FTP server.CVE-2017-152691.5% likely
20. Honeywell Alerton Compass Software 1.6.5 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and then im…CVE-2022-302451.4% likely
21. ILIAS before 7.16 allows External Control of File Name or Path.CVE-2022-459181.3% likely
22. libretime hv3.0.0-alpha.10 is affected by a path manipulation vulnerability in /blob/master/legacy/application/modules/rest/controllers/ShowImageController.php through the rename…CVE-2021-436851.2% likely
23. Ruby-MySQL Gem Client File ReadCVE-2021-3779Tomita Masahiro · 1.2% likely
24. Database bypassing any permissions in Metabase via SQlite attachCVE-2022-24854metabase · CVSS 8 · 1.1% likely

    Metabase

25. Anonymous user cache poisoning via development-mode header in DiscourseCVE-2021-43794discourse · CVSS 5.3 · 1.1% likely

    Discourse

26. An access issue was addressed with additional sandbox restrictions. This issue is fixed in Shortcuts 2.1.3 for iOS. A sandboxed process may be able to circumvent sandbox restricti…CVE-2019-7290Apple · 1.0% likely

    Apple

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.