Files created from interactive shell sessions in Cobalt RaQ microservers (e.g. .bashhistory) are world readable, and thus are accessible from the web server.
The siteUserMod.cgi program in Cobalt RaQ2 servers allows any Site Administrator to modify passwords for other users, site administrators, and possibly admin (root).
Denial of service in Linux syslogd via a large number of connections.