deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-42299
Published: 2022-10-03
Description: An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to a denial of service attack through the DiscoveryService service.
CVSS Score: 5.3 (MEDIUM)
References: https://www.veritas.com/content/support/en_US/security/VTS22-012#M3; https://www.veritas.com/content/support/en_US/security/VTS22-012#M3
CVE: CVE-2022-42300
Published: 2022-10-03
Description: An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server nbars process can be crashed resulting in a denial of service. (Note: the watchdog service will automatically restart the process.)
CVSS Score: 4.3 (MEDIUM)
References: https://www.veritas.com/content/support/en_US/security/VTS22-013#M2; https://www.veritas.com/content/support/en_US/security/VTS22-013#M2
CVE: CVE-2022-42301
Published: 2022-10-03
Description: An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) injection attack through the nbars process.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-611
References: https://www.veritas.com/content/support/en_US/security/VTS22-013#M1; https://www.veritas.com/content/support/en_US/security/VTS22-013#M1
CVE: CVE-2022-42302
Published: 2022-10-03
Description: An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a SQL Injection attack affecting the NBFSMCLIENT service.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-89
References: https://www.veritas.com/content/support/en_US/security/VTS22-011#C1; https://www.veritas.com/content/support/en_US/security/VTS22-011#C1
CVE: CVE-2022-42303
Published: 2022-10-03
Description: An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a second-order SQL Injection attack affecting the NBFSMCLIENT service by leveraging CVE-2022-42302.
CVSS Score: 8.0 (HIGH)
CWE: CWE-89
References: https://www.veritas.com/content/support/en_US/security/VTS22-011#H1; https://www.veritas.com/content/support/en_US/security/VTS22-011#H1
CVE: CVE-2022-42304
Published: 2022-10-03
Description: An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a SQL Injection attack affecting idm, nbars, and SLP manager code.
CVSS Score: 8.0 (HIGH)
CWE: CWE-89
References: https://www.veritas.com/content/support/en_US/security/VTS22-011#H2; https://www.veritas.com/content/support/en_US/security/VTS22-011#H2
CVE: CVE-2022-42305
Published: 2022-10-03
Description: An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to a Path traversal attack through the DiscoveryService service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://www.veritas.com/content/support/en_US/security/VTS22-012#M1; https://www.veritas.com/content/support/en_US/security/VTS22-012#M1
CVE: CVE-2022-42306
Published: 2022-10-03
Description: An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access can send a crafted packet to pbx_exchange during registration and cause a NULL pointer exception, effectively crashing the pbx_exchange process.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.veritas.com/content/support/en_US/security/VTS22-010#M1; https://www.veritas.com/content/support/en_US/security/VTS22-010#M1
CVE: CVE-2022-42307
Published: 2022-10-03
Description: An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) Injection attack through the DiscoveryService service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-611
References: https://www.veritas.com/content/support/en_US/security/VTS22-012#M2; https://www.veritas.com/content/support/en_US/security/VTS22-012#M2
CVE: CVE-2022-42308
Published: 2022-10-03
Description: An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access can delete arbitrary files by leveraging a path traversal in the pbx_exchange registration code.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-22
References: https://www.veritas.com/content/support/en_US/security/VTS22-010#C1; https://www.veritas.com/content/support/en_US/security/VTS22-010#C1
CVE: CVE-2022-33882
Published: 2022-10-03
Description: Under certain conditions, an attacker could create an unintended sphere of control through a vulnerability present in file delete operation in Autodesk desktop app (ADA). An attacker could leverage this vulnerability to escalate privileges and execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0015; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0015
CVE: CVE-2022-41443
Published: 2022-10-03
Description: phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-116
References: https://gist.github.com/enferas/7acd9636cc221bbf61d51425ab91ef01; https://gist.github.com/enferas/7acd9636cc221bbf61d51425ab91ef01
CVE: CVE-2022-42247
Published: 2022-10-03
Description: pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a file name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/enferas/b4ca7a4fb52e1b5e698f87e4d655a70a; https://github.com/pfsense/pfsense/commit/73ca6743954ac9f35ca293e3f2af63eac20cf32e; https://gist.github.com/enferas/b4ca7a4fb52e1b5e698f87e4d655a70a
CVE: CVE-2021-40556
Published: 2022-10-06
Description: A stack overflow vulnerability exists in the httpd service in ASUS RT-AX56U Router Version 3.0.0.4.386.44266. This vulnerability is caused by the strcat function called by "caupload" input handle function allowing the user to enter 0xFFFF bytes into the stack. This vulnerability allows an attacker to execute commands remotely. The vulnerability requires authentication.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://www.asus.com/tw/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/; https://x1ng.top/2021/10/14/ASUS%E6%A0%88%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/; https://www.asus.com/tw/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/
CVE: CVE-2022-22503
Published: 2022-10-06
Description: IBM Robotic Process Automation 21.0.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 227125.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/227125; https://www.ibm.com/support/pages/node/6825995; https://exchange.xforce.ibmcloud.com/vulnerabilities/227125
CVE: CVE-2022-26235
Published: 2022-10-06
Description: A vulnerability was discovered in the Remisol Advance v2.0.12.1 and below for the Normand Message Server. On installation, the permissions set by Remisol Advance allow non-privileged users to overwrite and/or manipulate executables and libraries that run as the elevated SYSTEM user on Windows.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://pastebin.com/amgw9pE7; https://www.beckmancoulter.com/products/clinical-information-management-tools/remisol-advance; https://pastebin.com/amgw9pE7
CVE: CVE-2022-26237
Published: 2022-10-06
Description: The default privileges for the running service Normand Viewer Service in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to overwrite and manipulate executables and libraries. This allows attackers to access sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://pastebin.com/DREqM7AT; https://www.beckmancoulter.com/products/clinical-information-management-tools/remisol-advance; https://pastebin.com/DREqM7AT
CVE: CVE-2022-26239
Published: 2022-10-06
Description: The default privileges for the running service Normand License Manager in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows unprivileged users to overwrite and manipulate executables and libraries. This allows attackers to access sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://pastebin.com/1QEHrj01; https://www.beckmancoulter.com/products/clinical-information-management-tools/remisol-advance; https://pastebin.com/1QEHrj01
CVE: CVE-2022-26240
Published: 2022-10-06
Description: The default privileges for the running service Normand Message Buffer in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to overwrite and manipulate executables and libraries. This allows attackers to access sensitive data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://pastebin.com/Bsy6KTxJ; https://www.beckmancoulter.com/products/clinical-information-management-tools/remisol-advance; https://pastebin.com/Bsy6KTxJ
CVE: CVE-2022-2637
Published: 2022-10-06
Description: Incorrect Privilege Assignment vulnerability in Hitachi Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation.This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.8.0 before 04.9.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-266, CWE-269
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2022-131/index.html; https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2022-131/index.html
CVE: CVE-2022-2781
Published: 2022-10-06
Description: In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-327
References: https://advisories.octopus.com/post/2022/sa2022-16/; https://advisories.octopus.com/post/2022/sa2022-16/
CVE: CVE-2022-2783
Published: 2022-10-06
Description: In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://advisories.octopus.com/post/2022/sa2022-17/; https://advisories.octopus.com/post/2022/sa2022-17/
CVE: CVE-2022-2975
Published: 2022-10-06
Description: A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modify accounts leading to execution of arbitrary code as the root user. This issue affects Application Enablement Services versions 8.0.0.0 through 8.1.3.4 and 10.1.0.0 through 10.1.0.1. Versions prior to 8.0.0.0 are end of manufacturing support and were not evaluated.
CVSS Score: 7.7 (HIGH)
CWE: CWE-269, CWE-732
References: https://download.avaya.com/css/public/documents/101083688; https://download.avaya.com/css/public/documents/101083688
CVE: CVE-2022-2986
Published: 2022-10-06
Description: Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-75326; https://bugzilla.redhat.com/show_bug.cgi?id=2121360; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-75326
CVE: CVE-2022-31008
Published: 2022-10-06
Description: RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: `3.10.2`, `3.9.18`, `3.8.32` are available. Users unable to upgrade should disable the Shovel and Federation plugins.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-330, CWE-335
References: https://github.com/rabbitmq/rabbitmq-server/pull/4841; https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-v9gv-xp36-jgj8; https://github.com/rabbitmq/rabbitmq-server/pull/4841
CVE: CVE-2022-31252
Published: 2022-10-06
Description: A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did not consider group writable path components, allowing local attackers with access to a group what can write to a location included in the path to a privileged binary to influence path resolution. This issue affects: SUSE Linux Enterprise Server 12-SP5 permissions versions prior to 20170707. openSUSE Leap 15.3 permissions versions prior to 20200127. openSUSE Leap 15.4 permissions versions prior to 20201225. openSUSE Leap Micro 5.2 permissions versions prior to 20181225.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://bugzilla.suse.com/show_bug.cgi?id=1203018; https://bugzilla.suse.com/show_bug.cgi?id=1203018
CVE: CVE-2022-32171
Published: 2022-10-06
Description: In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s credentials.
CWE: CWE-79, CWE-79
References: https://github.com/zinclabs/zinc/commit/3376c248bade163430f[PII_REDACTED]f0a82cd322d; https://www.mend.io/vulnerability-database/CVE-2022-32171; https://github.com/zinclabs/zinc/commit/3376c248bade163430f[PII_REDACTED]f0a82cd322d
CVE: CVE-2022-32172
Published: 2022-10-06
Description: In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’s credentials.
CWE: CWE-79, CWE-79
References: https://github.com/zinclabs/zinc/commit/3376c248bade163430f[PII_REDACTED]f0a82cd322d; https://www.mend.io/vulnerability-database/CVE-2022-32172; https://github.com/zinclabs/zinc/commit/3376c248bade163430f[PII_REDACTED]f0a82cd322d
CVE: CVE-2022-36774
Published: 2022-10-06
Description: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client proxy configuration. IBM X-Force ID: 233575.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/233575; https://www.ibm.com/support/pages/node/6826013; https://exchange.xforce.ibmcloud.com/vulnerabilities/233575
CVE: CVE-2022-37888
Published: 2022-10-06
Description: There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InnstantOS that address these security vulnerabilities.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-014.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf
CVE: CVE-2022-38709
Published: 2022-10-06
Description: IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 234291.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/234291; https://www.ibm.com/support/pages/node/6826011; https://exchange.xforce.ibmcloud.com/vulnerabilities/234291
CVE: CVE-2022-39222
Published: 2022-10-06
Description: Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients accepting tokens issued by those Dex instances) are affected by this vulnerability if they are running a version prior to 2.35.0. An attacker can exploit this vulnerability by making a victim navigate to a malicious website and guiding them through the OIDC flow, stealing the OAuth authorization code in the process. The authorization code then can be exchanged by the attacker for a token, gaining access to applications accepting that token. Version 2.35.0 has introduced a fix for this issue. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-200, CWE-862
References: https://github.com/dexidp/dex/commit/49471b14c8080ddb034d[PII_REDACTED]d378b7a634; https://github.com/dexidp/dex/security/advisories/GHSA-vh7g-p26c-j2cw; https://github.com/dexidp/dex/commit/49471b14c8080ddb034d[PII_REDACTED]d378b7a634
CVE: CVE-2022-39237
Published: 2022-10-06
Description: syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-347, CWE-327
References: https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e[PII_REDACTED]05daeaa; https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8; https://security.gentoo.org/glsa/202210-19
CVE: CVE-2022-39244
Published: 2022-10-06
Description: PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow vulnerability. Users connecting to untrusted clients are at risk. This issue has been patched and is available as commit c4d3498 in the master branch and will be included in releases 2.13 and later. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/pjsip/pjproject/commit/c4d34984ec92b3d5252a7d5cddd85a1d3a8001ae; https://github.com/pjsip/pjproject/security/advisories/GHSA-fq45-m3f7-3mhj; https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html
CVE: CVE-2022-39265
Published: 2022-10-06
Description: MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the `_Can manage settings?_` permission and may depend on configured file permissions. MyBB 1.8.31 resolves this issue with the commit `0cd318136a`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-74, CWE-77
References: https://github.com/mybb/mybb/blob/mybb_1830/install/resources/settings.xml#L2331-L2338; https://github.com/mybb/mybb/commit/0cd318136a10b029bb5c8a8f6dddf39d87519797; https://github.com/mybb/mybb/security/advisories/GHSA-hxhm-rq9f-7xj7
CVE: CVE-2022-39269
Published: 2022-10-06
Description: PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch from using SRTP media transport to using basic RTP upon SRTP restart, causing the media to be sent insecurely. The vulnerability impacts all PJSIP users that use SRTP. The patch is available as commit d2acb9a in the master branch of the project and will be included in version 2.13. Users are advised to manually patch or to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-319
References: https://github.com/pjsip/pjproject/commit/d2acb9af4e27b5ba75d658690406cec9c274c5cc; https://github.com/pjsip/pjproject/security/advisories/GHSA-wx5m-cj97-4wwg; https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html
CVE: CVE-2022-39270
Published: 2022-10-06
Description: DiscoTOC is a Discourse theme component that generates a table of contents for topics. Users that can create topics in TOC-enabled categories (and have sufficient trust level - configured in component's settings) are able to inject arbitrary HTML on that topic's page. The issue has been fixed on the `main` branch. Admins can update the theme component through the admin UI (Customize -> Themes -> Components -> DiscoTOC -> Check for Updates). Alternatively, admins can temporarily disable the DiscoTOC theme component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/discourse/DiscoTOC/commit/f80c215a283cd045d2a371403e6eba88b2911192; https://github.com/discourse/DiscoTOC/security/advisories/GHSA-m44p-w923-w32h; https://github.com/discourse/DiscoTOC/commit/f80c215a283cd045d2a371403e6eba88b2911192
CVE: CVE-2022-39273
Published: 2022-10-06
Description: FlyteAdmin is the control plane for the data processing platform Flyte. Users who enable the default Flyte’s authorization server without changing the default clientid hashes will be exposed to the public internet. In an effort to make enabling authentication easier for Flyte administrators, the default configuration for Flyte Admin allows access for Flyte Propeller even after turning on authentication via a hardcoded hashed password. This password is also set on the default Flyte Propeller configmap in the various Flyte Helm charts. Users who enable auth but do not override this setting in Flyte Admin’s configuration may unbeknownst to them be allowing public traffic in by way of this default password with attackers effectively impersonating propeller. This only applies to users who have not specified the ExternalAuthorizationServer setting. Usage of an external auth server automatically turns off this default configuration and are not susceptible to this vulnerability. This issue has been addressed in version 1.1.44. Users should manually set the staticClients in the selfAuthServer section of their configuration if they intend to rely on Admin’s internal auth server. Again, users who use an external auth server are automatically protected from this vulnerability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-798
References: https://docs.flyte.org/en/latest/deployment/cluster_config/auth_setup.html#oauth2-authorization-server; https://github.com/flyteorg/flyteadmin/pull/478; https://github.com/flyteorg/flyteadmin/security/advisories/GHSA-67x4-qr35-qvrm