Arbitrary file creation and program execution using FLEXlm LicenseManager, from versions 4.0 to 5.0, in IRIX.

IRIX fam service allows an attacker to obtain a list of all files on the server.

Telnet allows a remote client to specify environment variables including LD_LIBRARY_PATH, allowing an attacker to bypass the normal system libraries and gain root access.

pcnfsd (aka rpc.pcnfsd) allows local users to change file permissions, or execute arbitrary commands through arguments in the RPC call.

getcwd() file descriptor leak in FTP.

The printers program in IRIX has a buffer overflow that gives root access to local users.

Buffer overflow in SGI IRIX mailx program.

The handler CGI program in IRIX allows arbitrary command execution.

The wrap CGI program in IRIX allows remote attackers to view arbitrary directory listings via a .. (dot dot) attack.

Denial of service in RPC portmapper allows attackers to register or unregister RPC services or spoof RPC services using a spoofed source IP address such as 127.0.0.1.

Guessable magic cookies in X Windows allows remote attackers to execute commands, e.g. through xterm.

Bash treats any character with a value of 255 as a command separator.

Buffer overflow in xlock program allows local users to execute commands as root.

Routed allows attackers to append data to files.

Directory traversal vulnerability in pfdispaly.cgi program (sometimes referred to as "pfdisplay") for SGI's Performer API Search Tool (performer_tools) allows remote attackers to read arbitrary files.

disk_bandwidth on SGI IRIX 6.4 S2MP for Origin/Onyx2 allows local users to gain root access using relative pathnames.

ioconfig on SGI IRIX 6.4 S2MP for Origin/Onyx2 allows local users to gain root access using relative pathnames.

SGI syserr program allows local users to corrupt files.

SGI permissions program allows local users to gain root privileges.

rpc.ypupdated (NIS) allows remote users to execute arbitrary commands.