CVE-2023-44464

The CVE-2023-44464 issue affects pretix prior to 2023.7.2 where Pillow can parse EPS files, enabling an attacker-controlled EPS payload to potentially compromise the application. Affected product: pretix (ticketing system) with Pillow EPS parsing as the root cause. Reported impacts in connected s...

CVE-2023-44463

CVE-2023-44463 affects pretix versions before 2023.7.1. The issue arises from incorrect parsing of configuration files, causing the application to trust unchecked X-Forwarded-For headers even when not configured to do so. This can enable IP address spoofing by users of the application and may aff...

CVE-2023-27891

CVE-2023-27891 concerns rami.io pretix prior to version 4.17.1. The vulnerability allows OAuth application authorization from a logged-out session, exposing an unauthorized OAuth flow. Affected product: pretix (rami.io). Root cause and impact are described consistently across sources: the issue e...