Attacks could run the gamut from arbitrary file injection to man-in-the-middle attacks to cross-site request forgery (CSRF).from http://ift.tt/1FhDTYp