CVE-2008-3424
Chain: product does not properly handle wildcards in an authorization policy list, allowing unintended access.
CVE-2008-4577
ACL-based protection mechanism treats negative access rights as if they are positive, allowing bypass of intended restrictions.