[MEDIUM] CVE-2021-21424: Prevent user enumeration via response content in authentication mechanisms

PKSA-8ws6-qn2n-55bs CVE-2021-21424 GHSA-5pv8-ppvj-4h68

Affected version: >=2.8.0,<3.0.0|>=3.0.0,<3.1.0|>=3.1.0,<3.2.0|>=3.2.0,<3.3.0|>=3.3.0,<3.4.0|>=3.4.0,<3.4.49|>=4.0.0,<4.1.0|>=4.1.0,<4.2.0|>=4.2.0,<4.3.0|>=4.3.0,<4.4.0|>=4.4.0,<4.4.24

Reported by:
GitHub, FriendsOfPHP/security-advisories

[HIGH] CVE-2020-5275: All rules set in "access_control" are required when the firewall is configured with the unanimous strategy

PKSA-dtfj-z29g-v2fb CVE-2020-5275 GHSA-g4m9-5hpf-hx72

Affected version: >=4.4.0,<4.4.7

Reported by:
GitHub, FriendsOfPHP/security-advisories