Deepjyoti Roy

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The payment integration with Oppwa-based payment methods fails to properly validate payment status responses. This allows an attacker to reuse a successful payment status response from one transaction and apply it to a different payment, enabling the acquisition of multiple valid tickets using a single payment. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The payment integration with Computop-based payment methods fails to properly validate payment status responses. This allows an attacker to reuse a successful payment status response from one transaction and apply it to a different payment, enabling the acquisition of multiple valid tickets using a single payment. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** pretix (affected versions not specified) **Description** An insecure direct object reference exists when creating exports through the API. API clients receive a UUID (Universally Unique Identifier) for export jobs to request the actual file for download. A specific API endpoint fails to verify if the provided UUID belongs to a file intended for download or if it belongs to the requesting user. Exploitation requires the attacker to obtain a valid UUID for the target file, which typically necessitates access to system logs or a separate security breach. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.