Venukamatchi

**Name of the Vulnerable Software and Affected Versions** Nodemailer versions prior to 8.0.8 **Description** Nodemailer disables TLS certificate verification in its internal HTTPS fetch client located in `lib/fetch/index.js` by setting `rejectUnauthorized: false`. This configuration causes OAuth2 token requests to trust invalid or self-signed HTTPS certificates, bypassing hostname validation and CA chain verification. Consequently, an attacker in a machine-in-the-middle position can intercept sensitive OAuth credentials transmitted over compromised HTTPS connections, including the `client secret`, `refresh token`, and access tokens. **Recommendations** Update Nodemailer to version 8.0.8 or later.

**Name of the Vulnerable Software and Affected Versions** Open Source Point of Sale (opensourcepos) versions prior to 3.4.2 **Description** The application is a web-based point of sale system written in PHP using the CodeIgniter framework. A security issue exists where an authenticated user with limited privileges can access the password change functionality for other users, including administrators. This is possible by manipulating the `employee id` parameter without proper authorization checks or verification of object ownership. The application does not verify that the current user has permission to modify the account associated with the specified `employee id`. Version 3.4.2 introduces object-level authorization checks to validate ownership of the `employee id` being accessed. **Recommendations** Versions prior to 3.4.2 should be updated to version 3.4.2 or later.