Ben Reser

The issue allows remote attackers to bypass intended access restrictions and possibly cause a denial of service via a relative URL in a REPORT request. This is due to the `is this legal` function in `mod dontdothat`.

The issue allows remote authenticated users to cause a denial of service, potentially resulting in an assertion failure or out-of-bounds read. This can be achieved by sending a certain request against a revision root, specifically via COPY, DELETE, or MOVE requests.

The issue allows remote authenticated users to cause a denial of service, resulting in a crash due to a NULL pointer dereference. This can be achieved through a LOCK on an activity URL.

The issue allows remote attackers to cause a denial of service, resulting in a segmentation fault and crash of the Apache HTTPD server module. This is achieved by sending a log REPORT request with an invalid limit, which triggers an access of an uninitialized variable.

A cross-site scripting issue exists due to a lack of validation on output, potentially allowing remote attackers to inject arbitrary web script or HTML. This could be related to the `name` and `title` parameters.