CWE-392 vulnerabilities

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.

The OCPP implementation in libocpp before 0.26.2 allows a denial of service (EVerest crash) via JSON input larger than 255 characters, because a CiString<255> object is created with StringTooLarge set to Throw.

NVIDIA Jetson Linux contains a vulnerability in UEFI Management mode, where an unprivileged local attacker may cause exposure of sensitive information via a side channel vulnerability. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

CVE-2024-12797 is a vulnerability in OpenSSL versions 3.2.0, 3.3.0, and 3.4.0 affecting TLS and DTLS connections that use RFC7250 Raw Public Keys (RPKs) for server authentication. Clients that enable RPKs and rely on SSL_VERIFY_PEER verification mode may fail to detect server authentication failures because the handshake does not abort as expected. This can allow man-in-the-middle attacks if the client does not explicitly check the verification result. The issue does not affect OpenSSL FIPS modules and only arises when RPKs are explicitly enabled by both client and server.