[HIGH] CVE-2018-11406: CSRF Token Fixation

PKSA-3grm-n326-q5z3 CVE-2018-11406 GHSA-g4g7-q726-v5hg

Affected version: >=2.0.0,<2.1.0|>=2.1.0,<2.2.0|>=2.2.0,<2.3.0|>=2.3.0,<2.4.0|>=2.4.0,<2.5.0|>=2.5.0,<2.6.0|>=2.6.0,<2.7.0|>=2.7.0,<2.7.48|>=2.8.0,<2.8.41|>=3.0.0,<3.1.0|>=3.1.0,<3.2.0|>=3.2.0,<3.3.0|>=3.3.0,<3.3.17|>=3.4.0,<3.4.11|>=4.0.0,<4.0.11

Reported by:
GitHub, FriendsOfPHP/security-advisories

[HIGH] CVE-2018-11385: Session Fixation Issue for Guard Authentication

PKSA-zk3t-cmdy-sy2k CVE-2018-11385 GHSA-g4rg-rw65-8hfg

Affected version: >=2.0.0,<2.1.0|>=2.1.0,<2.2.0|>=2.2.0,<2.3.0|>=2.3.0,<2.4.0|>=2.4.0,<2.5.0|>=2.5.0,<2.6.0|>=2.6.0,<2.7.0|>=2.7.0,<2.7.48|>=2.8.0,<2.8.41|>=3.0.0,<3.1.0|>=3.1.0,<3.2.0|>=3.2.0,<3.3.0|>=3.3.0,<3.3.17|>=3.4.0,<3.4.11|>=4.0.0,<4.0.11

Reported by:
GitHub, FriendsOfPHP/security-advisories

Possible DOS attack with long user-submitted passwords

PKSA-9qgs-5jdb-1mfq CVE-2013-5958

Affected version: >=2.0.0,<2.0.25|>=2.1.0,<2.1.13|>=2.2.0,<2.2.9|>=2.3.0,<2.3.6

Reported by:
FriendsOfPHP/security-advisories

[MEDIUM] Routes behind a firewall are accessible even when not logged in

PKSA-468d-qs45-4h29 CVE-2012-6431 GHSA-83c3-qx27-2rwr

Affected version: >=2.0.0,<2.0.19

Reported by:
GitHub, FriendsOfPHP/security-advisories