167 matches found
AZL-13781 CVE-2022-3162 affecting package keda for versions less than 2.4.0-29
Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...
AZL-33598 CVE-2022-32149 affecting package keda for versions less than 2.4.0-23
An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse...
AZL-34839 CVE-2022-32149 affecting package keda for versions less than 2.14.0-1
An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse...
AZL-34836 CVE-2021-44716 affecting package keda for versions less than 2.14.0-1
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests...
AZL-33597 CVE-2021-44716 affecting package keda for versions less than 2.4.0-19
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests...
Weak Password Vulnerability in KEDACOM Network Keyboard Console at Suzhou KEDA Technology Co.
Ltd. is a provider of video and security products and solutions. A weak password vulnerability exists in the KEDACOM Network Keyboard Console of Suzhou KEDA Technology Company Limited, which can be exploited by attackers to obtain sensitive information...
