Timhaines

The `proxy-cache` and `proxy-cache-advanced` plugins omit the request hostname from the cache key. This behavior can lead to a cache key collision, where a response cached for one hostname is incorrectly served to a request for a different hostname.

The `graphql-proxy-cache-advanced` plugin fails to include the caller's identity within the cache key. This flaw allows a cached response intended for one user to be incorrectly served to a different caller.

The `proxy-cache` and `proxy-cache-advanced` plugins fail to escape separator characters during the construction of the cache key. This flaw allows a remote attacker to trigger a cache key collision, resulting in a cached response from one request being incorrectly served to a different request on the same Route.

An issue exists in the conversation and contact filter APIs where user-supplied values in the `values` field of the filter payload are interpolated directly into SQL queries without parameterization when filtering by custom attributes of type date or number using the `is greater than` or `is less than` operators. This allows an authenticated user with account access to execute arbitrary SQL via time-based blind injection. Affected endpoints include '/api/v1/accounts/{account id}/conversations/filter', '/api/v1/accounts/{account id}/contacts/filter', and '/api/v1/accounts/{account id}/custom attribute definitions'.