CakePHP allows remote attackers to spoof their IP

CVE-2016-4793

Affected version: >=3.2.0-rc1,<3.2.5|>=3.1.0-beta1,<3.1.12|>=3.0.0-rc1,<3.0.17|>=2.8.0-rc1,<2.8.2|>=2.7.0-rc1,<2.7.11|>=1.2.0,<2.6.13

Reported by:
GitHub

Cross-Site Request Forgery in CakePHP

CVE-2020-15400

Affected version: <3.10.3|>=4.0.0,<4.0.6

Reported by:
GitHub

Unsafe deserialization in SmtpTransport

CVE-2019-11458

Affected version: >=3.0.0,<3.5.18|>=3.6.0,<3.6.15|>=3.7.0,<3.7.7

Reported by:
FriendsOfPHP/security-advisories, GitHub