CVE-2009-4013
Software package maintenance program allows overwriting arbitrary files using "../" sequences.
CVE-2009-4449
Bulletin board allows attackers to determine the existence of files using the avatar.