Buffer overflow of rlogin program using TERM environmental variable.

Buffer overflow in HP-UX newgrp program.

Vacation program allows command execution by remote users through a sendmail command.

pcnfsd (aka rpc.pcnfsd) allows local users to change file permissions, or execute arbitrary commands through arguments in the RPC call.

The AIX FTP client can be forced to execute commands from a malicious server through shell metacharacters (e.g. a pipe character).

A later variation on the Teardrop IP denial of service attack, a.k.a. Teardrop-2.

swinstall and swmodify commands in SD-UX package in HP-UX systems allow local users to create or overwrite arbitrary files to gain root access.

Sendmail allows local users to write to a file and gain group permissions via a .forward or :include: file.

Local users can start Sendmail in daemon mode and gain root privileges.

Buffer overflow and denial of service in Sendmail 8.7.5 and earlier through GECOS field gives root access to local users.

Expreserve, as used in vi and ex, allows local users to overwrite arbitrary files and gain root access.

The suidperl and sperl program do not give up root privileges when changing UIDs back to the original users, allowing root access.

Denial of service of inetd on Linux through SYN and RST packets.

HP Remote Watch allows a remote user to gain root access.

Buffer overflow in HP-UX cstm program allows local users to gain root privileges.

HP-UX gwind program allows users to modify arbitrary files.

HP-UX vgdisplay program gives root access to local users.

fpkg2swpk in HP-UX allows local users to gain root access.

HP ypbind allows attackers with root privileges to modify NIS data.

Buffer overflow in xmcd 2.0p12 allows local users to gain access through an environmental variable.