[LOW] CVE-2024-50341: Security::login does not take into account custom user_checker

PKSA-nzkq-gsnx-t6bw CVE-2024-50341 GHSA-jxgr-3v7q-3w9v

Affected version: >=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.10|>=7.0.0,<7.0.10|>=7.1.0,<7.1.3

Reported by:
GitHub, FriendsOfPHP/security-advisories

[MEDIUM] CVE-2022-24895: Possible CSRF token fixation

PKSA-4w9w-fp7s-ddy7 CVE-2022-24895 GHSA-3gv2-29qc-v67m

Affected version: >=2.0.0,<2.1.0|>=2.1.0,<2.2.0|>=2.2.0,<2.3.0|>=2.3.0,<2.4.0|>=2.4.0,<2.5.0|>=2.5.0,<2.6.0|>=2.6.0,<2.7.0|>=2.7.0,<2.8.0|>=2.8.0,<3.0.0|>=3.0.0,<3.1.0|>=3.1.0,<3.2.0|>=3.2.0,<3.3.0|>=3.3.0,<3.4.0|>=3.4.0,<4.0.0|>=4.0.0,<4.1.0|>=4.1.0,<4.2.0|>=4.2.0,<4.3.0|>=4.3.0,<4.4.0|>=4.4.0,<4.4.50|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.20|>=6.0.0,<6.0.20|>=6.1.0,<6.1.12|>=6.2.0,<6.2.6

Reported by:
GitHub, FriendsOfPHP/security-advisories

[MEDIUM] CVE-2021-41268: Remember me cookie persistance after password changes

PKSA-zjt8-sfvq-83xx CVE-2021-41268 GHSA-qw36-p97w-vcqr

Affected version: >=5.3.0,<5.3.12

Reported by:
GitHub, FriendsOfPHP/security-advisories

[HIGH] CVE-2018-11406: CSRF Token Fixation

PKSA-4896-hty4-6d37 CVE-2018-11406 GHSA-g4g7-q726-v5hg

Affected version: >=2.0.0,<2.1.0|>=2.1.0,<2.2.0|>=2.2.0,<2.3.0|>=2.3.0,<2.4.0|>=2.4.0,<2.5.0|>=2.5.0,<2.6.0|>=2.6.0,<2.7.0|>=2.7.0,<2.7.48|>=2.8.0,<2.8.41|>=3.0.0,<3.1.0|>=3.1.0,<3.2.0|>=3.2.0,<3.3.0|>=3.3.0,<3.3.17|>=3.4.0,<3.4.11|>=4.0.0,<4.0.11

Reported by:
GitHub, FriendsOfPHP/security-advisories

[MEDIUM] CVE-2018-11408: Open redirect vulnerability on security handlers

PKSA-3dcr-nqbc-hq8v CVE-2018-11408 GHSA-7hwc-2cq4-6x2w

Affected version: >=2.7.38,<2.7.48|>=2.8.0,<2.8.41|>=3.0.0,<3.1.0|>=3.1.0,<3.2.0|>=3.2.0,<3.3.0|>=3.3.0,<3.3.17|>=3.4.0,<3.4.11|>=4.0.0,<4.0.11

Reported by:
GitHub, FriendsOfPHP/security-advisories