Amir Azam

The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to perform certain actions without the victim's consent. Specifically, attackers can (1) add arbitrary accounts via the "join form" page and (2) change the privileges of arbitrary groups via the "prefs groups overview" page.

The issue allows remote attackers to obtain administrative privileges by sniffing the network, as a base64 encoded form of the `username` and `password` is placed in the " ac" cookie for the admin account.

The issue allows remote attackers to obtain access by sniffing the network, as a base64 encoded form of the `username` and `password` is placed in the ` ac` cookie for all user accounts.

The issue concerns the handling of user authentication states. Specifically, it does not record users' authentication states and implements the logout feature solely on the client side. This makes it easier for context-dependent attackers to reuse a logged-out session.

The issue allows remote attackers to gain permanent access to an account by sniffing the network, due to the use of invariant data when calculating an HMAC-SHA1 value for an authentication cookie. This makes it easier for attackers to exploit the system.