David Glick

The issue allows remote attackers to obtain random numbers and derive the PRNG state for password resets. This could potentially be used to gain unauthorized access.

The issue allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id. This is possible due to the way `z3c.form` is used in Plone.

The issue allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character in the ZPublisher.HTTPRequest. scrubHeader function.