Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the SupressNotFound middleware in middleware/supressnotfound.go. An unauthenticated attacker can send a request to a mounted path whose suffix also matches a public root route...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the SupressNotFound middleware in middleware/supressnotfound.go. An unauthenticated attacker can send a request to a mounted path whose suffix also matches a public root route...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the SupressNotFound middleware in middleware/supressnotfound.go. An unauthenticated attacker can send a request to a mounted path whose suffix also matches a public root route...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the SupressNotFound middleware in middleware/supressnotfound.go. An unauthenticated attacker can send a request to a mounted path whose suffix also matches a public root route...

GHSA-6W3M-4HHP-775Q KEDA has PostgreSQL connection string parameter injection via incomplete whitespace escaping

Summary pkg/scalers/postgresqlscaler.go builds libpq-style connection strings by concatenating key=value pairs separated by spaces. Each tenant-controllable field host, port, userName, dbName, sslmode is passed through escapePostgreConnectionParameter: go func escapePostgreConnectionParameterstr...