Remote attackers could obtain potentially sensitive information from exception messages printed by the error handler in non-debug mode.

CVE-2018-6010

Affected version: <2.0.14

Reported by:
FriendsOfPHP/security-advisories

The switchIdentity() function in yii\web\User did not regenerate the CSRF token upon a change of identity

CVE-2018-6009

Affected version: <2.0.14

Reported by:
FriendsOfPHP/security-advisories