named-xfer in AIX 4.1.5 and 4.2.1 allows members of the system group to overwrite system files to gain root access via the -f parameter and a malformed zone file.

SMTP component of Lotus Domino 4.6.1 on AS/400, and possibly other operating systems, allows a remote attacker to crash the mail server via a long string.

The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods, which allows remote attackers to execute arbitrary commands.

An SSH 1.2.27 server allows a client to use the "none" cipher, even if it is not allowed by the server policy.

The Disney Go Express Search allows remote attackers to access and modify search information for users by connecting to an HTTP server on the user's system.

xsoldier program allows local users to gain root access via a long argument.

Buffer overflow in VDO Live Player allows remote attackers to execute commands on the VDO client via a malformed .vdo file.

Groupwise web server GWWEB.EXE allows remote attackers to determine the real path of the web server via the HELP parameter.

Groupwise web server GWWEB.EXE allows remote attackers to read arbitrary files with .htm extensions via a .. (dot dot) attack using the HELP parameter.

Buffer overflow in the POP server POProxy for the Norton Anti-Virus protection NAV2000 program via a large USER command.

War FTP Daemon 1.70 allows remote attackers to cause a denial of service by flooding it with connections.

Netscape Navigator uses weak encryption for storing a user's Netscape mail password.

Cisco Cache Engine allows a remote attacker to gain access via a null username and password.

The web administration interface for Cisco Cache Engine allows remote attackers to view performance statistics.

Microsoft SQL 7.0 server allows a remote attacker to cause a denial of service via a malformed TDS packet.

Cisco Cache Engine allows an attacker to replace content in the cache.

wu-ftp with FTP conversion enabled allows an attacker to execute commands via a malformed file name that is interpreted as an argument to the program that does the conversion, e.g. tar or uncompress.

Buffer overflow in Infoseek Ultraseek search engine allows remote attackers to execute commands via a long GET request.

Windows NT Local Security Authority (LSA) allows remote attackers to cause a denial of service via malformed arguments to the LsaLookupSids function which looks up the SID, aka "Malformed Security Identifier Request."

Windows NT with SYSKEY reuses the keystream that is used for encrypting SAM password hashes, allowing an attacker to crack passwords.