HotPatch 2 Groupwise 8 and HotPatch 3 for Groupwise 7

Today I noticed that Novell has release HotPatch 2 for Groupwise 8. If you look on download.novell.com you will see a explication mark behind the patch, indicating there is a security issue.

If you look in the readme of Groupwise 8 in the security second it will say:

Novell GroupWise WebAccess is vulnerable to weaknesses within the session management mechanisms that could potentially allow an attacker to gain access to an authenticated user’s account.
Affected versions:
GroupWise 7.0 up to 7.03 HP2
GroupWise 8.0 up to 8.0.0 HP1
(Novell bug 472979, CVE-2009-1634)

Novell GroupWise WebAccess is vulnerable to a cross-site scripting (XSS) exploit via unfiltered style expressions, which could potentially allow an attacker to send a message with an HTML file that contains malicious scripts, which could redirect a user and/or forward data & requests to a malicious site.
Affected versions:
GroupWise 7.0 up to 7.03 HP2
GroupWise 8.0 up to 8.0.0 HP1
(Novell bug 472987, CVE-2009-1635)

A vulnerability exists in Novell GroupWise WebAccess in the that way it blocks scripting. Exploitation of this vulnerability could potentially allow an attacker to gain access to an authenticated user’s mailbox and forward data & requests to a malicious site.
Affected versions:
GroupWise 7.0 up to 7.03 HP2
GroupWise 8.0 up to 8.0.0 HP1
(Novell bug 474500, CVE-2009-1635)

A vulnerability exists in Novell GroupWise WebAccess that could allow an attacker to use Javascript to deface the login page, which could potentially prevent users from logging in to WebAccess.
Affected versions:
GroupWise 7.0 up to 7.03 HP2
GroupWise 8.0 up to 8.0.0 HP1
(Novell bug 484942, CVE-2009-1635)

A vulnerability exists in Novell GroupWise Internet Agent, in the way it processes certain SMTP requests. Exploitation of this vulnerability could lead to arbitrary code execution with SYSTEM privileges.
Affected versions:
GroupWise 7.0 up to 7.03 HP2
GroupWise 8.0 up to 8.0.0 HP1
(Novell bug 478892, CVE-2009-1636)

A vulnerability exists in the Novell GroupWise Internet Agent, in the way it processes email addresses in the SMTP protocol. Exploitation of this vulnerability could lead to arbitrary code execution with SYSTEM privileges.
Affected versions:
GroupWise 7.0 up to 7.03 HP2
GroupWise 8.0 up to 8.0.0 HP1
(Novell bug 482914, CVE-2009-1636)

Bug 501443 – Notify connects to the wrong mailbox, bypassing authentication in unique configurations.

And in the readme of Groupwise 7:

501443 – Notify connects to the wrong mailbox, bypassing authentication in unique circumstances

So if you don’t applied this hotfixes, it’s possible that other people connect to your mailbox thourgh notify. How? I don’t know.
But I sure don’t want this to happen!