GHSA-2XC6-348P-C2X6 Sylius affected by IDOR in Cart and Checkout LiveComponents

Impact An authenticated Insecure Direct Object Reference IDOR vulnerability exists in multiple shop LiveComponents due to unvalidated resource IDs accepted via LiveArg parameters. Unlike props, which are protected by LiveComponent's @checksum, args are fully user-controlled - any action that...

CVE-2024-24752

Bref CVE-2024-24752 affects AWS Lambda deployments using Bref with the Event-Driven Function runtime and a RequestHandlerInterface. During multipart handling, uploaded parts that are files are saved to /tmp with random names starting bref_upload_ and are not deleted after the request is processed...