Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/seriation-0.1+git20200810.df036aa/cfm-seriation.c

FINAL RESULTS:

data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:418:6:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
					strcpy(nodes[pos],protein);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:445:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
				strcpy(alloc_nodes[n_nodes],node_left);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:450:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
				strcpy(alloc_nodes[n_nodes],node_right);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:463:8:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
							strcpy(alloc_nodes[n_nodes],node_right);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:482:9:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
								strcpy(alloc_nodes[n_nodes],node_left);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:489:9:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
								strcpy(alloc_nodes[n_nodes],node_right);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:550:2:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
	sprintf(frame_name,"%s/frame%d",frame_path,frame_cnt);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:552:2:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
	sprintf(command,"gnuplot -p -e \"load '/usr/share/cfm-seriation/etc/matrix.gnu';set output '%s.png';filename='%s';set multiplot;p '%s.dat' w dots lt 0;set xrange [0:%d];load '/usr/share/cfm-seriation/etc/video.gnu'\"",frame_name,gnuplot_path,frame_name,monte_carlo_steps);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:554:2:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
	sprintf(frame_name,"%s/frame%d.dat",frame_path,frame_cnt);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:570:2:  [4] (shell) system:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
	system(command);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:571:2:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
	sprintf(command,"rm %s",frame_name);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:572:2:  [4] (shell) system:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
	system(command);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:646:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
		sprintf(dir_name,"%s_%s",dat_name,time_name);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:651:4:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
			sprintf(frame_path,"%s/frames",dir_name);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:657:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
		sprintf(result_path,"%s/result.txt",dir_name);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:739:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
		sprintf(order_path,"%s/initial_order.dat",dir_name);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:747:4:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
			sprintf(gnuplot_path,"%s/initial",dir_name);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:749:4:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
			sprintf(command,"gnuplot -p -e \"load '/usr/share/cfm-seriation/etc/matrix.gnu'; set output '%s.png';p '%s.dat' w dots lt 0\"",gnuplot_path,gnuplot_path);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:750:4:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
			sprintf(gnuplot_path,"%s/initial.dat",dir_name);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:777:4:  [4] (shell) system:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
			system(command);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:792:2:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
	sprintf(gnuplot_path,"%s/energy.dat",dir_name);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:878:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
		sprintf(gnuplot_path,"%s/energy",dir_name);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:880:4:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
			sprintf(command,"gnuplot -p -e \"filename='%s.dat';set output '%s.png';set xrange [0:%d];load '/usr/share/cfm-seriation/etc/energy.gnu'\"",gnuplot_path,gnuplot_path,options.mc_steps);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:881:4:  [4] (shell) system:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
			system(command);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:883:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
		sprintf(gnuplot_path,"%s/final",dir_name);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:884:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
		sprintf(command,"gnuplot -p -e \"load '/usr/share/cfm-seriation/etc/matrix.gnu'; set output '%s.png';p '%s.dat' w dots lt 0\"",gnuplot_path,gnuplot_path);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:885:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
		sprintf(gnuplot_path,"%s/final.dat",dir_name);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:892:2:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
	sprintf(order_path,"%s/final_order.dat",dir_name);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:916:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
		sprintf(command,"avconv -v quiet -r 10 -i %s/frame%s.png -r 10 -vcodec libx264 -b 3000k %s/%s.mp4",frame_path,"%d",dir_name,dir_name);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:917:3:  [4] (shell) system:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
		system(command);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:918:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
		sprintf(command,"rm -rf %s",frame_path);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:919:3:  [4] (shell) system:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
		system(command);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:928:2:  [4] (shell) system:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
	system(command);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:706:4:  [3] (random) srand:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
			srand(options.seed);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:798:2:  [3] (random) srand:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
	srand(options.seed);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:78:32:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
				options.cooling_interval = atoi(&argv[x][2]);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:81:24:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
				options.mc_steps = atoi(&argv[x][2]);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:93:20:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
				options.seed = atoi(&argv[x][2]);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:371:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char line[80], *line_ptr, *node_left, *node_right;
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:400:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char line[80], *line_ptr, *protein, *pos_ptr, *end_ptr;
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:429:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char line[80], *line_ptr, *node_left, *node_right;
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:555:16:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	frame_image = fopen(frame_name,"w+");
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:614:13:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		datfile = fopen(options.file_name,"r");
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:658:12:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		result = fopen(result_path,"w+");
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:682:13:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		datfile = fopen(options.file_name,"r");
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:691:12:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
			order = fopen(options.order_file, "r");
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:740:11:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		order = fopen(order_path,"w+");
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:752:14:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
			gnuplot = fopen(gnuplot_path,"w+");
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:793:11:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	energy = fopen(gnuplot_path,"w+");
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:886:13:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		gnuplot = fopen(gnuplot_path,"w+");
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:893:10:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	order = fopen(order_path,"w+");
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:407:20:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		protein_length = strlen(protein) + 1;
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:438:22:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		node_left_length = strlen(node_left) + 1;
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:440:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		node_right_length = strlen(node_right) + 1;
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:549:31:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	frame_name = (char*) malloc((strlen(frame_path) + 12)*sizeof(char));
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:551:28:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	command = (char*) malloc((strlen(frame_name) + (strlen(gnuplot_path) + strlen(frame_name)) + 143 + 58)*sizeof(char));
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:551:50:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	command = (char*) malloc((strlen(frame_name) + (strlen(gnuplot_path) + strlen(frame_name)) + 143 + 58)*sizeof(char));
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:551:73:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	command = (char*) malloc((strlen(frame_name) + (strlen(gnuplot_path) + strlen(frame_name)) + 143 + 58)*sizeof(char));
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:553:43:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	frame_name = (char*) realloc(frame_name,(strlen(frame_path) + 16)*sizeof(char));
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:630:4:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
			strncpy(dat_name,options.file_name,ext_str);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:636:4:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
			strncpy(dat_name,&options.file_name[bar_char + 1],(ext_str - bar_char - 1));
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:640:4:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
			strncpy(path_name,options.file_name,bar_char);
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:645:30:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		dir_name = (char*) malloc((strlen(dat_name) + strlen(time_name) + 2)*sizeof(char));
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:645:49:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		dir_name = (char*) malloc((strlen(dat_name) + strlen(time_name) + 2)*sizeof(char));
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:650:33:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			frame_path = (char*) malloc((strlen(dir_name) + 8)*sizeof(char));
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:656:33:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		result_path = (char*) malloc((strlen(dir_name) + 12)*sizeof(char));
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:737:32:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		order_path = (char*) malloc((strlen(dir_name) + 19)*sizeof(char));
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:738:34:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		gnuplot_path = (char*) malloc((strlen(dir_name) + 13)*sizeof(char));
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:748:30:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			command = (char*) malloc((strlen(dir_name) + (strlen(gnuplot_path) *2) + 125 + 29)*sizeof(char));
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:748:50:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			command = (char*) malloc((strlen(dir_name) + (strlen(gnuplot_path) *2) + 125 + 29)*sizeof(char));
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:915:30:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			command = (char*) malloc((strlen(frame_path) + (strlen(dir_name) *2) + 74)*sizeof(char));
data/seriation-0.1+git20200810.df036aa/cfm-seriation.c:915:52:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			command = (char*) malloc((strlen(frame_path) + (strlen(dir_name) *2) + 74)*sizeof(char));

ANALYSIS SUMMARY:

Hits = 72
Lines analyzed = 942 in approximately 0.05 seconds (17380 lines/second)
Physical Source Lines of Code (SLOC) = 814
Hits@level = [0]  83 [1]  21 [2]  16 [3]   2 [4]  33 [5]   0
Hits@level+ = [0+] 155 [1+]  72 [2+]  51 [3+]  35 [4+]  33 [5+]   0
Hits/KSLOC@level+ = [0+] 190.418 [1+] 88.4521 [2+] 62.6536 [3+] 42.9975 [4+] 40.5405 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.