VU#431093: TCG TPM 2.0 reference code found vulnerable to information leakage and timing side-channel attacks

CERT/CC vulnerability notes report multiple serious flaws across TPM 2.0 reference code, OpenCart, stb_truetype, SOGo, VPS.org deployment templates, SGLang, and foreUP. Issues include cryptographic information leakage and timing attacks, path traversal enabling web-shell deployment, heap buffer overflow, actively exploited XSS with mailbox compromise, exposed default credentials and secrets, unauthenticated RCE and SSRF, and payment credential disclosure with broken object-level authorization. Several issues lack patches at publication; SOGo recommends upgrading to 5.12.8 or newer.