Remote password change in trac.torproject account
I was trying to recover my password and I tried to register my user again so a noticed there is a vulnerability, any user can actually change any users password.
Go to:
https://trac.torproject.org/projects/tor/register
Just put any username with the password you want and then that is going to automatically change it.
Trac:
Username: Dedalo
To upload designs, you'll need to enable LFS and have admin enable hashed storage. More information