Extra long export lists over 256 characters in some mount daemons allows NFS directories to be mounted by anyone.

Automount daemon automountd allows local or remote users to gain privileges via shell metacharacters.

The SunView (SunTools) selection_svc facility allows remote users to read files.

rpc.ypupdated (NIS) allows remote users to execute arbitrary commands.

Remote attacker can execute commands through Majordomo using the Reply-To field and a "lists" command.

MIME buffer overflow in Sendmail 8.8.0 and 8.8.1 gives root access.

Denial of service in Sendmail 8.6.11 and 8.6.12.

Sendmail 8.6.9 allows remote attackers to execute root commands, using ident.

In Sendmail, attackers can gain root privileges via SMTP by specifying an improper "mail from" address and an invalid "rcpt to" address that would cause the mail to bounce to a program.

The GNU tar command, when used in FTP sessions, may allow an attacker to execute arbitrary commands.

A quote cwd command on FTP servers can reveal the full path of the home directory of the "ftp" user.

Windows NT FTP server (WFTP) with the guest account enabled without a password allows an attacker to log into the FTP server using any username and password.

manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow attackers to access a dangling pointer in an application whose developer was unaware of a documentation update from 1999.

finger .@host on some systems may print information on some user accounts.

finger 0@host on some systems may print information on some user accounts.

websendmail in Webgais 1.0 allows a remote user to access arbitrary files and execute arbitrary code via the receiver parameter ($VAR_receiver variable).

Denial of service in RPC portmapper allows attackers to register or unregister RPC services or spoof RPC services using a spoofed source IP address such as 127.0.0.1.

Denial of service in in.comsat allows attackers to generate messages.

Denial of service in Ascend and 3com routers, which can be rebooted by sending a zero length TCP option.

Buffer overflow in telnet daemon tgetent routing allows remote attackers to gain root access via the TERMCAP environmental variable.