Garvin Hicking

Changing backend users passwords through the user settings module causes the cleartext password to be stored in the `uc` and `user settings` fields of the `be users` database table.

In multi-site scenarios, enumerating the HTTP query parameters `id` and `L` allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that was publicly available.

A cross-site request forgery issue allows remote attackers to perform unauthorized actions as an arbitrary user via unspecified vectors.