My favorite vulnerability is not often mentioned: The sendmail config file used to have a completely byzantine syntax. Consequently, there was a default wizard password that would grant total strangers access, with the understanding that these would be whitehat wizards breaking in to fix your braindamaged mail configuration.

The reason for the "whitehat" assumption was really that no one had seen any other color of hat (because why would you break in and do something malicious wtf haven't you got anything better to do?)

Simpler times.