The company is recommending that administrators apply the patch immediately.
The worst vulnerability lies in the software's user authentication function, according to Microsoft. At least one page included with the default Web server would allow a hacker to overrun the buffer, giving him control of the system the software is running on.
The scope of the vulnerability could be significantly reduced if the URL scan tool was deployed on the server. It is likely that in this case, the vulnerability could only be used for denial of service attacks.
The third vulnerability lies in the software's database feature, and allows an attacker to take any action on the database and run some operating system commands, as well. However, it would not give the attacker any administrative privileges on the server.