Ruslan Kabalin

The issue allows remote authenticated users to read the messages of a different user via a modified `replyto` parameter in the "Reply to message" feature.

The issue arises from improper handling of an https URL in the wwwroot configuration setting. This makes it easier for remote attackers to obtain credentials by sniffing the network when an http URL is used for a login.

The issue allows remote authenticated institution administrators to reset a site administrator password.