CVE-2004-0274
Product mistakenly assigns a particular status to an entity, leading to increased privileges.
CVE-2007-4217
FTP client program on a certain OS runs with setuid privileges and has a buffer overflow. Most clients do not need extra privileges, so an overflow is not a vulnerability for those clients.