Btcpayserver
9 CVEs across 3 Btcpayserver products. Browse Btcpayserver vulnerabilities, severities, and proof-of-concept exploits.
Btcpayserver products with known CVEs
Btcpayserver CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2023-1270 | Medium | 5.4 | 2023-03-08 | Cross-site Scripting in GitHub repository btcpayserver/btcpayserver prior to 1.8.3. |
CVE-2023-1149 | Medium | 5.4 | 2023-03-02 | Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0. |
CVE-2023-0879 | Medium | 6.3 | 2023-02-17 | Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.12.
|
CVE-2023-0810 | Medium | 5.4 | 2023-02-13 | Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.11. |
CVE-2023-0748 | Medium | 6.4 | 2023-02-08 | Open Redirect in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.
|
CVE-2023-0747 | Medium | 5.5 | 2023-02-08 | Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.
|
CVE-2022-32984 | High | 7.5 | 2023-01-31 | BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed. The sensitive informatio… |
CVE-2023-0493 | Medium | 5.3 | 2023-01-26 | Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.
|
CVE-2021-3830 | Medium | 5.4 | 2021-09-26 | btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3646 | Medium | 6.1 | 2021-09-10 | btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-29250 | Medium | 5.4 | 2021-05-05 | BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting (XSS) vulnerability within the POS Add Products functionality. This enables cookie ste… |
CVE-2021-29248 | Medium | 5.3 | 2021-05-05 | BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the Secure flag for a cookie. |
CVE-2021-29247 | Medium | 5.3 | 2021-05-05 | BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for a cookie. |
CVE-2021-29246 | Medium | 6.7 | 2021-05-05 | BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achieve code execution. The attacker must cra… |
CVE-2021-29245 | Medium | 5.3 | 2021-05-05 | BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key. |
CVE-2021-29251 | Medium | 6.5 | 2021-04-01 | BTCPay Server before 1.0.7.1 mishandles the policy setting in which users can register (in Server Settings > Policies). This affects Docker use cases in which… |
CVE-2021-29249 | High | 7.5 | 2021-03-26 | BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability. |