SCO Doctor allows local users to gain root privileges through a Tools option.

Buffer overflow in bootpd on OpenBSD, FreeBSD, and Linux systems via a malformed header type.

The default permissions for UnixWare /var/mail allow local users to read and modify other users' mail.

UnixWare pkg commands such as pkginfo, pkgcat, and pkgparam allow local users to read arbitrary files via the dacread permission.

Buffer overflow in SCO UnixWare Xsco command via a long argument.

Denial of service in BIND named via malformed SIG records.

UnixWare uidadmin allows local users to modify arbitrary files via a symlink attack.

Buffer overflow in SCO su program allows local users to gain root access via a long username.

Denial of service in BIND named via naptr.

UnixWare programs that dump core allow a local user to modify files via a symlink attack on the ./core.pid file.

A weak encryption algorithm is used for passwords in SCO TermVision, allowing them to be easily decrypted by a local user.

UnixWare pkgtrans allows local users to read arbitrary files via a symlink attack.

Several startup scripts in SCO OpenServer Enterprise System v 5.0.4p, including S84rpcinit, S95nis, S85tcp, and S89nfs, are vulnerable to a symlink attack, allowing a local user to gain root access.

The SCO UnixWare privileged process system allows local users to gain root privileges by using a debugger such as gdb to insert traps into _init before the privileged process is executed.

UnixWare dos7utils allows a local user to gain root privileges by using the STATICMERGE environmental variable to find a script which it executes.

Buffer overflow in mscreen on SCO OpenServer 5.0 and SCO UNIX 3.2v4 allows a local user to gain root access via (1) a long TERM environmental variable and (2) a long entry in the .mscreenrc file.

SCO UNIX System V/386 Release 3.2, and other SCO products, installs the home directories (1) /tmp for the dos user, and (2) /usr/tmp for the asg user, which allows other users to gain access to those accounts since /tmp and /usr/tmp are world-writable.

Vulnerability in passwd in SCO UNIX 4.0 and earlier allows attackers to cause a denial of service by preventing users from being able to log into the system.

Buffer overflows in wuarchive ftpd (wu-ftpd) and ProFTPD lead to remote root access, a.k.a. palmetto.

userOsa in SCO OpenServer allows local users to corrupt files via a symlink attack.