CVE-2006-6679
Product relies on the X-Forwarded-For HTTP header for authorization, allowing unintended access by spoofing the header.
CVE-2005-3623
OS kernel does not check for a certain privilege before setting ACLs for files.