Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
query, the query changes from `password` to `t1.password`. `password` is protected by filtering protections but `t1.password` is not protected. This can lead to filtering attacks on everything related to the object again, including admin passwords and reset-tokens. Version 4.10.8 fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/strapi/strapi/security/advisories/GHSA-9xg4-3qfm-9w8f - https://github.com/strapi/strapi/releases/tag/v4.10.8
CVE ID: CVE-2023-34236 State: PUBLISHED Published: 2023-07-14T21:09:46.350Z Last Updated: 2024-10-22T14:00:20.867Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: weaveworks Products: tf-controller Problem Types: CWE-200 Description: Weave GitOps Terraform Controller (aka Weave TF-controller) is a controller for Flux to reconcile Terraform resources in a GitOps way. A vulnerability has been identified in Weave GitOps Terraform Controller which could allow an authenticated remote attacker to view sensitive information. This vulnerability stems from Weave GitOps Terraform Runners (`tf-runner`), where sensitive data is inadvertently printed - potentially revealin
from Weave GitOps Terraform Runners (`tf-runner`), where sensitive data is inadvertently printed - potentially revealing sensitive user data in their pod logs. In particular, functions `tfexec.ShowPlan`, `tfexec.ShowPlanRaw`, and `tfexec.Output` are implicated when the `tfexec` object set its `Stdout` and `Stderr` to be `os.Stdout` and `os.Stderr`. An unauthorized remote attacker could exploit this vulnerability by accessing these prints of sensitive information, which may contain configurations or tokens that could be used to gain unauthorized control or access to resources managed by the Terraform controller. A successful exploit could allow the attacker to utilize this sensitive data, po
es managed by the Terraform controller. A successful exploit could allow the attacker to utilize this sensitive data, potentially leading to unauthorized access or control of the system. This vulnerability has been addressed in Weave GitOps Terraform Controller versions `v0.14.4` and `v0.15.0-rc.5`. Users are urged to upgrade to one of these versions to mitigate the vulnerability. As a temporary measure until the patch can be applied, users can add the environment variable `DISABLE_TF_LOGS` to the tf-runners via the runner pod template of the Terraform Custom Resource. This will prevent the logging of sensitive information and mitigate the risk of this vulnerability. Additional Analyst Notes
will prevent the logging of sensitive information and mitigate the risk of this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/weaveworks/tf-controller/security/advisories/GHSA-6hvv-j432-23cv - https://github.com/weaveworks/tf-controller/issues/637 - https://github.com/weaveworks/tf-controller/issues/649 - https://github.com/weaveworks/tf-controller/commit/28282bc644054e157c3b9a3d38f1f9551ce09074 - https://github.com/weaveworks/tf-controller/commit/6323b355bd7f5d2ce85d0244fe0883af3881df4e - https://github.com/weaveworks/tf-controller/commit/9708fda28ccd0466cb0a8fd409854ab4d92f7dca - https://github.com/weaveworks/tf
//github.com/weaveworks/tf-controller/commit/9708fda28ccd0466cb0a8fd409854ab4d92f7dca - https://github.com/weaveworks/tf-controller/commit/98a0688036e9dbcf43fa84960d9a1ef3e09a69cf
CVE ID: CVE-2023-34237 State: PUBLISHED Published: 2023-06-07T19:50:50.417Z Last Updated: 2025-02-13T16:55:24.235Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: sabnzbd Products: sabnzbd Problem Types: CWE-94 Description: SABnzbd is an open source automated Usenet download tool. A design flaw was discovered in SABnzbd that could allow remote code execution. Manipulating the Parameters setting in the Notification Script functionality allows code execution with the privileges of the SABnzbd process. Exploiting the vulnerabilities requires access to the web interface. Remote exploitation is possible if users[exposed their setup to the internet or other untruste
ess to the web interface. Remote exploitation is possible if users[exposed their setup to the internet or other untrusted networks without setting a username/password. By default SABnzbd is only accessible from `localhost`, with no authentication required for the web interface. This issue has been patched in commits `e3a722` and `422b4f` which have been included in the 4.0.2 release. Users are advised to upgrade. Users unable to upgrade should ensure that a username and password have been set if their instance is web accessible. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-hhgh-xgh3-985r - https://github.com/sabn
iner: References: - https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-hhgh-xgh3-985r - https://github.com/sabnzbd/sabnzbd/commit/422b4fce7bfd56e95a315be0400cdfdc585df7cc - https://github.com/sabnzbd/sabnzbd/commit/e3a722664819d1c7c8fab97144cc299b1c18b429 - https://sabnzbd.org/wiki/configuration/4.0/general - https://security.gentoo.org/glsa/202312-11
CVE ID: CVE-2023-34238 State: PUBLISHED Published: 2023-06-07T23:24:49.724Z Last Updated: 2025-01-06T20:32:10.440Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: gatsbyjs Products: gatsby Problem Types: CWE-22 Description: Gatsby is a free and open source framework based on React. The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the `__file-code-frame` and `__original-stack-frame` paths, exposed when running the Gatsby develop server (`gatsby develop`). Any file in scope of the development server could potentially be exposed. It should be noted that by default `gatsby develop` is only accessible via the
ment server could potentially be exposed. It should be noted that by default `gatsby develop` is only accessible via the localhost `127.0.0.1`, and one would need to intentionally expose the server to other interfaces to exploit this vulnerability by using server options such as `--host 0.0.0.0`, `-H 0.0.0.0`, or the `GATSBY_HOST=0.0.0.0` environment variable. A patch has been introduced in `gatsby@5.9.1` and `gatsby@4.25.7` which mitigates the issue. Users are advised to upgrade. Users unable to upgrade should avoid exposing their development server to the internet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gatsbyjs/gatsby/s
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gatsbyjs/gatsby/security/advisories/GHSA-c6f8-8r25-c4gc - https://github.com/gatsbyjs/gatsby/commit/ae5a654eb346b2e7a9d341b809b2f82d34c0f17c - https://github.com/gatsbyjs/gatsby/commit/fc22f4ba3ad7ca5fb3592f38f4f0ca8ae60b4bf7
CVE ID: CVE-2023-34239 State: PUBLISHED Published: 2023-06-07T23:20:06.549Z Last Updated: 2025-01-06T20:33:11.589Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: gradio-app Products: gradio Problem Types: CWE-20 Description: Gradio is an open-source Python library that is used to build machine learning and data science. Due to a lack of path filtering Gradio does not properly restrict file access to users. Additionally Gradio does not properly restrict the what URLs are proxied. These issues have been addressed in version 3.34.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Contai
dvised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gradio-app/gradio/security/advisories/GHSA-3qqg-pgqq-3695 - https://github.com/gradio-app/gradio/pull/4370 - https://github.com/gradio-app/gradio/pull/4406
CVE ID: CVE-2023-34240 State: PUBLISHED Published: 2023-06-27T16:34:15.157Z Last Updated: 2024-11-27T16:59:34.445Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: CloudExplorer-Dev Products: CloudExplorer-Lite Problem Types: CWE-521 Description: Cloudexplorer-lite is an open source cloud software stack. Weak passwords can be easily guessed and are an easy target for brute force attacks. This can lead to an authentication system failure and compromise system security. Versions of cloudexplorer-lite prior to 1.2.0 did not enforce strong passwords. This vulnerability has been fixed in version 1.2.0. Users are advised to upgrade. There are no known workarounds f
ords. This vulnerability has been fixed in version 1.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/security/advisories/GHSA-px4m-5j22-5mw4
CVE ID: CVE-2023-34241 State: PUBLISHED Published: 2023-06-22T22:39:32.400Z Last Updated: 2025-02-13T16:55:24.787Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenPrinting Products: cups Problem Types: CWE-416 Description: OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process. The exact cause of this issue is the function `httpClose(co
a use-after-free bug that impacts the entire cupsd process. The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is warn or higher and in two scenarios: there is a double-lookup for the IP Address (HostNameLookups Double is set in `cupsd.conf`) which fails to resolve, or if CUPS is compiled with TCP wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`. Version
compiled with TCP wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`. Version 2.4.6 has a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 - https://github.com/OpenPrinting/cups/commit/9809947a959e18409dcf562a3466ef246cb90cb2 - https://github.com/OpenPrinting/cups/releases/tag/v2.4.6 - http://www.openwall.com/lists/oss-security/2023/06/23/10 - http://www.openwall.com/lists/oss-security/2023/06/26/1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TBIYKDS3UG3W4Z7YOH
26/1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TBIYKDS3UG3W4Z7YOHTR2AWFNBRYPNYY/ - https://lists.debian.org/debian-lts-announce/2023/06/msg00038.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7I7DWGYGEMBNLZF5UQBMF3SONR37YUBN/ - https://support.apple.com/kb/HT213843 - https://support.apple.com/kb/HT213844 - https://support.apple.com/kb/HT213845
CVE ID: CVE-2023-34242 State: PUBLISHED Published: 2023-06-15T19:07:14.624Z Last Updated: 2024-12-11T21:11:29.299Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) Vendors: cilium Products: cilium Problem Types: CWE-200 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to version 1.13.4, when Gateway API is enabled in Cilium, the absence of a check on the namespace in which a ReferenceGrant is created could result in Cilium unintentionally gaining visibility of secrets (including certificates) and services across namespaces. An attacker on an affected cluster can leverage this issue to use cluster secrets that s
and services across namespaces. An attacker on an affected cluster can leverage this issue to use cluster secrets that should not be visible to them, or communicate with services that they should not have access to. Gateway API functionality is disabled by default. This vulnerability is fixed in Cilium release 1.13.4. As a workaround, restrict the creation of `ReferenceGrant` resources to admin users by using Kubernetes RBAC. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cilium/cilium/security/advisories/GHSA-r7wr-4w5q-55m6 - https://github.com/cilium/cilium/releases/tag/v1.13.4
CVE ID: CVE-2023-34243 State: PUBLISHED Published: 2023-06-08T21:09:14.628Z Last Updated: 2025-01-06T19:27:20.871Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: tgstation Products: tgstation-server Problem Types: CWE-200 Description: TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server (TGS), an attacker could discover their username by brute-forcing the login endpoint with an invalid password. When a valid Windows logon was found, a distinct response would be generated. This issue has been addressed in version 5.12.5. Users are advised to upgrade. Users unable to upgrade may b
generated. This issue has been addressed in version 5.12.5. Users are advised to upgrade. Users unable to upgrade may be mitigated by rate-limiting API calls with software that sits in front of TGS in the HTTP pipeline such as fail2ban. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tgstation/tgstation-server/security/advisories/GHSA-w3jx-4x93-76ph - https://github.com/tgstation/tgstation-server/pull/1526
CVE ID: CVE-2023-34244 State: PUBLISHED Published: 2023-07-05T19:22:07.569Z Last Updated: 2024-10-21T21:11:18.143Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-79 Description: GLPI is a free asset and IT management software package. Starting in version 9.4.0 and prior to version 10.0.8, a malicious link can be crafted by an unauthenticated user that can exploit a reflected XSS in case any authenticated user opens the crafted link. Users should upgrade to version 10.0.8 to receive a patch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-p93p-pwg9-w95w - https://github.com/glpi-project/glpi/releases/tag/10.0.8
CVE ID: CVE-2023-34245 State: PUBLISHED Published: 2023-06-09T17:04:23.815Z Last Updated: 2025-01-06T18:13:51.501Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: udecode Products: plate Problem Types: CWE-79 Description: @udecode/plate-link is the link handler for the udecode/plate rich-text editor plugin system for Slate & React. Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the `javascript:` scheme. As a result, links with JavaScript URLs can be inserted into the Plate editor through various means, including opening or pasting malicious content. `@udecode/plate-link` 20.0.0 resolves this issue by introduci
ous means, including opening or pasting malicious content. `@udecode/plate-link` 20.0.0 resolves this issue by introducing an `allowedSchemes` option to the link plugin, defaulting to `['http', 'https', 'mailto', 'tel']`. URLs using a scheme that isn't in this list will not be rendered to the DOM. Users are advised to upgrade. Users unable to upgrade are advised to override the `LinkElement` and `PlateFloatingLink` components with implementations that explicitly check the URL scheme before rendering any anchor elements. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/udecode/plate/security/advisories/GHSA-4882-hxpr-hrvm - https://g
ISA ADP Vulnrichment: References: - https://github.com/udecode/plate/security/advisories/GHSA-4882-hxpr-hrvm - https://github.com/udecode/plate/commit/93dd5712854660874900ae12e4d8e6ff28089eb7
CVE ID: CVE-2023-34246 State: PUBLISHED Published: 2023-06-12T16:33:05.704Z Last Updated: 2025-02-13T16:55:25.344Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: doorkeeper-gem Products: doorkeeper Problem Types: CWE-287 Description: Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referen
his issue is fixed in version 5.6.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-7w2c-w47h-789w - https://github.com/doorkeeper-gem/doorkeeper/issues/1589 - https://github.com/doorkeeper-gem/doorkeeper/pull/1646 - https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v5.6.6 - https://www.rfc-editor.org/rfc/rfc8252#section-8.6 - https://lists.debian.org/debian-lts-announce/2023/07/msg00016.html
CVE ID: CVE-2023-34247 State: PUBLISHED Published: 2023-06-13T16:31:31.545Z Last Updated: 2025-01-03T18:07:02.632Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N) Vendors: keystonejs Products: keystone Problem Types: CWE-601 Description: Keystone is a content management system for Node.JS. There is an open redirect in the `@keystone-6/auth` package versions 7.0.0 and prior, where the redirect leading `/` filter can be bypassed. Users may be redirected to domains other than the relative host, thereby it might be used by attackers to re-direct users to an unexpected location. To mitigate this issue, one may apply a patch from pull request 8626 or avoid using the `@keys
o an unexpected location. To mitigate this issue, one may apply a patch from pull request 8626 or avoid using the `@keystone-6/auth` package. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/keystonejs/keystone/security/advisories/GHSA-jqxr-vjvv-899m - https://github.com/keystonejs/keystone/pull/8626
CVE ID: CVE-2023-34249 State: PUBLISHED Published: 2023-06-13T16:40:44.556Z Last Updated: 2025-01-03T18:05:40.878Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: benjjvi Products: PyBB Problem Types: CWE-89 Description: benjjvi/PyBB is an open source bulletin board. Prior to commit dcaeccd37198ecd3e41ea766d1099354b60d69c2, benjjvi/PyBB is vulnerable to SQL Injection. This vulnerability has been fixed as of commit dcaeccd37198ecd3e41ea766d1099354b60d69c2. As a workaround, a user may be able to update the software manually to avoid this problem by sanitizing user queries to `BulletinDatabaseModule.py`. Additional Analyst Notes: - CVE Program Container: - CI
oblem by sanitizing user queries to `BulletinDatabaseModule.py`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/benjjvi/PyBB/security/advisories/GHSA-5qrx-fgxq-95gg - https://github.com/benjjvi/PyBB/commit/dcaeccd37198ecd3e41ea766d1099354b60d69c2
CVE ID: CVE-2023-34250 State: PUBLISHED Published: 2023-06-13T21:41:29.652Z Last Updated: 2025-01-02T21:08:05.472Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: discourse Products: discourse Problem Types: CWE-200 Description: Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, an attacker could use the new topics dismissal endpoint to reveal the number of topics recently created (but not the actual content thereof) in categories they didn't have access to. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the
they didn't have access to. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-q8m5-wmjr-3ppg
CVE ID: CVE-2023-34251 State: PUBLISHED Published: 2023-06-14T21:31:31.908Z Last Updated: 2024-12-27T16:52:56.757Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: getgrav Products: grav Problem Types: CWE-94 Description: Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/getgrav/grav/security/advisories/
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/getgrav/grav/security/advisories/GHSA-f9jf-4cp4-4fq5 - https://github.com/getgrav/grav/commit/9d01140a63c77075ef09b26ef57cf186138151a5 - https://github.com/getgrav/grav/blob/develop/system/src/Grav/Common/Twig/Extension/GravExtension.php#L174
CVE ID: CVE-2023-34252 State: PUBLISHED Published: 2023-06-14T21:38:48.358Z Last Updated: 2024-12-18T19:03:09.288Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: getgrav Products: grav Problem Types: CWE-184, CWE-1336 Description: Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function whereby validation against a denylist of unsafe functions is only performed when the argument passed to filter is a string. However, passing an array as a callable argument allows the validation check to be skipped. Consequently, a low privileged attacker with login access to Grav Admin panel a
lows the validation check to be skipped. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution. The vulnerability can be found in the `GravExtension.filterFilter()` function declared in `/system/src/Grav/Common/Twig/Extension/GravExtension.php`. Version 1.7.42 contains a patch for this issue. End users should also ensure that `twig.undefined_functions` and `twig.undefined_filters` properties in `/path/to/webroot/system/config/system.yaml` configuration file are set to `false` to disallow Twig from treating undefined filters/functions as PHP functions and executin
uration file are set to `false` to disallow Twig from treating undefined filters/functions as PHP functions and executing them. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/getgrav/grav/security/advisories/GHSA-96xv-rmwj-6p9w - https://github.com/getgrav/grav/commit/244758d4383034fe4cd292d41e477177870b65ec - https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Twig/Extension/GravExtension.php#L1692-L1698 - https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Utils.php#L1956-L2074