CVE-2009-2960
Web application does not restrict access to admin scripts, allowing authenticated users to modify passwords of other users.
CVE-2009-3230
Database server does not use appropriate privileges for certain sensitive operations.