ICMP information such as (1) netmask and (2) timestamp is allowed from arbitrary hosts.

ICMP echo (ping) is allowed from arbitrary hosts.

The permissions for a system-critical NIS+ table (e.g. passwd) are inappropriate.

An NIS domain name is easily guessable.

A system-critical NETBIOS/SMB share has inappropriate access control.

A NETBIOS/SMB share password is the default, null, or missing.

A NETBIOS/SMB share password is guessable.

An SNMP community name is the default (e.g. public), null, or missing.

An SNMP community name is guessable.

An unrestricted remote trust relationship for Unix systems has been set up, e.g. by using a + sign in /etc/hosts.equiv.

UDP messages to broadcast addresses are allowed, allowing for a Fraggle attack that can cause a denial of service by flooding the target.

ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service.

A mail server is explicitly configured to allow SMTP mail relay, which allows abuse by spammers.

IP forwarding is enabled on a machine which is not a router or firewall.

A router or firewall allows source routed packets from arbitrary hosts.

Perl, sh, csh, or other shell interpreters are installed in the cgi-bin directory on a WWW site, which allows remote attackers to execute arbitrary commands.

An account on a router, firewall, or other network device has a default, null, blank, or missing password.

An account on a router, firewall, or other network device has a guessable password.

A Windows NT domain user or administrator account has a default, null, blank, or missing password.

A Windows NT domain user or administrator account has a guessable password.