Well, they managed to find a new one... quite nasty:
The flaws could result in DoS, improper validation of user credentials, or -- most seriously -- the ability to access (and change) files from the device file system, including saved configurations. The configuration file often contains passwords and other sensitive information, Cisco warned.
If an administrator has specifically enabled and configured the IOS FTP server the device could be vulnerable, Cisco said. Cisco IOS releases based on mainline versions 11.3, 12.0, 12.1, 12.2, 12.3 and 12.4 contain the IOS FTP server. IOS XR is not vulnerable, according to Cisco.
Here
and
here