15 - unvalidated redirects
17 - guessable session tokens
18 - weak password checker
19 - logic authentication flaw
updated password checking
Merge pull request #1 from hidroh/15,17-19

15,17 19