KDE kppp allows local users to create a directory in an arbitrary location via the HOME environmental variable.

Nestea variation of teardrop IP fragmentation denial of service.

Linux bdash game has a buffer overflow that allows local users to gain root access.

Denial of service of inetd on Linux through SYN and RST packets.

File creation and deletion, and remote execution, in the BSD line printer daemon (lpd).

Linux implementations of TFTP would allow access to files outside the restricted directory.

rpc.mountd on Linux, Ultrix, and possibly other operating systems, allows remote attackers to determine the existence of a file on the server by attempting to mount that file, which generates different error messages depending on whether the file exists or not.

Listening TCP ports are sequentially allocated, allowing spoofing attacks.

Denial of service in RPC portmapper allows attackers to register or unregister RPC services or spoof RPC services using a spoofed source IP address such as 127.0.0.1.

The rwho/rwhod service is running, which exposes machine status and user information.

NFS cache poisoning.

Denial of service in syslog by sending it a large number of superfluous messages.

Some configurations of NIS+ in Linux allowed attackers to log in as the user "+".