It can not do anything to the client system. A cookie is a short piece of data, not executable code. It can not do anything to the client system. A cookie can only include information that is contained in the cookie and that which was originally sent to the browser by the issuing server. No additional personal information is sent to the server by the cookie.
Web servers can read all of the cookies that are set by all of the sites that a user visits.
Cookies are a serious security risk. This is just not true. There has yet to be a documented case of a security breach associated with cookies. The QRZ server architecture requires that users accept transient cookies if they want to receive personalized or customized information, or if they want to take advantage of the single signon capabilities of the server. Static content can still be made available to users who choose not accept cookies.