relative paths on system() call, format string bugs, etc.
vulners.com/securityvulns/securityvulns:doc:5318