The access permissions for a UNIX domain socket are ignored in Solaris 2.x and SunOS 4.x, and other BSD-based operating systems before 4.4, which could allow local users to connect to the socket and possibly disrupt or control the operations of the program using that socket.

NFS cache poisoning.

The Sun sdtcm_convert calendar utility for OpenWindows has a buffer overflow which can gain root access.

An SNMP community name is the default (e.g. public), null, or missing.

The WorkMan program can be used to overwrite any file to get root access.

Expreserve, as used in vi and ex, allows local users to overwrite arbitrary files and gain root access.

Local user gains root privileges via buffer overflow in rdist, via expstr() function.

Extra long export lists over 256 characters in some mount daemons allows NFS directories to be mounted by anyone.

In Solaris 2.2 and 2.3, when fsck fails on startup, it allows a local user with physical access to obtain root access.

The permissions for the /dev/audio device on Solaris 2.2 and earlier, and SunOS 4.1.x, allow any local user to read from the device, which could be used by an attacker to monitor conversations happening near a machine that has a microphone.