HP CDE program includes the current directory in root's PATH variable.
Buffer overflow in TTSESSION environment variable in ToolTalk shared library allows local users to gain root privileges.
The suidperl and sperl program do not give up root privileges when changing UIDs back to the original users, allowing root access.