CVE-2020-15245: Ability to switch customer email address on account detail page and stay verified

CVE-2020-15245

Affected version: >=1.0.0,<1.1.0|>=1.1.0,<1.2.0|>=1.2.0,<1.3.0|>=1.3.0,<1.4.0|>=1.4.0,<1.5.0|>=1.5.0,<1.6.0|>=1.6.0,<1.6.9|>=1.7.0,<1.7.9|>=1.8.0,<1.8.3

Reported by:
FriendsOfPHP/security-advisories

CVE-2020-5220: Ability to define unintended serialisation groups via HTTP header which might lead to data exposure

CVE-2020-5220

Affected version: >=1.0.0,<1.1.0|>=1.1.0,<1.2.0|>=1.2.0,<1.3.0|>=1.3.0,<1.3.12|>=1.4.0,<1.4.4

Reported by:
FriendsOfPHP/security-advisories

CVE-2019-12186: XSS injection in the Grid component

CVE-2019-12186

Affected version: >=1.0.0,<1.1.0|>=1.1.0,<1.1.18|>=1.2.0,<1.2.17|>=1.3.0,<1.3.12|>=1.4.0,<1.4.4

Reported by:
FriendsOfPHP/security-advisories

CSRF vulnerability in the admin panel

Affected version: >=1.0.0,<1.0.17|>=1.1.0,<1.1.9|>=1.2.0,<1.2.2

Reported by:
FriendsOfPHP/security-advisories