CVE-2006-6679
Product relies on the X-Forwarded-For HTTP header for authorization, allowing unintended access by spoofing the header.
CVE-2005-2801
Chain: file-system code performs an incorrect comparison (CWE-697), preventing default ACLs from being properly applied.