HP CDE program includes the current directory in root's PATH variable.
Buffer overflow in TTSESSION environment variable in ToolTalk shared library allows local users to gain root privileges.
An SNMP community name is the default (e.g. public), null, or missing.
Denial of service of inetd on Linux through SYN and RST packets.
The suidperl and sperl program do not give up root privileges when changing UIDs back to the original users, allowing root access.
Teardrop IP denial of service.