Multiple vulnerabilities in setup script (CVE-2016-6621 / PMASA-2016-44).
Open redirect (PMASA-2017-1).
php-gettext code execution (CVE-2015-8980 / PMASA-2017-2).
DOS vulnerability in table editing (PMASA-2017-3).
CSS injection in themes (PMASA-2017-4).
SSRF in replication (PMASA-2017-6).
DOS in replication status (PMASA-2017-7).