TI-2023-00467 CVE-2023-0493
Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver
Priority HIGH 77
Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.
btcpayserver
Records18All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
btcpayserver records in CISA KEVNo btcpayserver vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
13 records in Btcpay Server · all components
TI-2023-00834 CVE-2023-0879 · GHSA-wh8v-v378-r87r
Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver
Priority MEDIUM 61
Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.12.
TI-2023-01087 CVE-2023-1149 · GHSA-h5wq-xq9g-pppc
Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver
Priority MEDIUM 58
Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0.
TI-2022-14495 CVE-2022-32984 · GHSA-mpjh-c64m-g538
BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive…
Priority MEDIUM 41
BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed.
TI-2021-10062 CVE-2021-29249 · GHSA-xgwm-rhgp-jr5w
BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability.
Priority LOW 35
BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability.
TI-2021-10059 CVE-2021-29246 · GHSA-6w4p-96gh-fgfp
BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker…
Priority LOW 33
BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achieve code execution.
TI-2021-10064 CVE-2021-29251 · GHSA-8qq9-8h7f-8qvp
BTCPay Server before 1.0.7.1 mishandles the policy setting in which users can register…
Priority LOW 30
BTCPay Server before 1.0.7.1 mishandles the policy setting in which users can register (in Server Settings > Policies).
TI-2021-02591 CVE-2021-3646 · GHSA-p4ww-48c6-98q5
Cross-site Scripting (XSS) - Reflected in btcpayserver/btcpayserver
Priority LOW 29
btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
TI-2021-10061 CVE-2021-29248 · GHSA-gxgq-96mg-778q
BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive…
Priority LOW 26
BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the Secure flag for a cookie.
TI-2021-10060 CVE-2021-29247 · GHSA-9f24-x4vj-q8g2
BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive…
Priority LOW 26
BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for a cookie.
TI-2021-10058 CVE-2021-29245 · GHSA-6p4w-gcxh-hf6c
BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key.
Priority LOW 26
BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key.
TI-2021-10063 CVE-2021-29250 · GHSA-28x9-v6gq-r37m
BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting (XSS)…
Priority LOW 25
BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting (XSS) vulnerability within the POS Add Products functionality.
TI-2021-02761 CVE-2021-3830 · GHSA-3xmg-w8wr-4536
Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver
Priority LOW 25
btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')