Venukamatchi

The `socket.getaddrinfo()` function accepts null bytes within the `host` and `port` parameters, which may lead to the values being silently truncated.

Nodemailer disables TLS certificate verification in its internal HTTPS fetch client located in `lib/fetch/index.js` by setting `rejectUnauthorized: false`. This configuration causes OAuth2 token requests to trust invalid or self-signed HTTPS certificates, bypassing hostname validation and CA chain verification. Consequently, an attacker in a machine-in-the-middle position can intercept sensitive OAuth credentials transmitted over compromised HTTPS connections, including the `client secret`, `refresh token`, and access tokens.

The application is a web-based point of sale system written in PHP using the CodeIgniter framework. A security issue exists where an authenticated user with limited privileges can access the password change functionality for other users, including administrators. This is possible by manipulating the `employee id` parameter without proper authorization checks or verification of object ownership. The application does not verify that the current user has permission to modify the account associated with the specified `employee id`. Version 3.4.2 introduces object-level authorization checks to validate ownership of the `employee id` being accessed.