Skip to content
Noroxi

btcpayserver records

17 published records for vendor btcpayserver.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 21
  2. 23

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

17 records
  • CVE-2023-0493
    37Monitor

    Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver

    HighCVSS 8.8Proof of conceptEPSS 8%

    btcpayserver · btcpay serverJan 26, 2023

  • CVE-2021-29249
    30Monitor

    BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability.

    HighCVSS 7.5No exploitEPSS 1%

    btcpayserver · btcpay serverMar 26, 2021

  • CVE-2022-32984
    30Monitor

    BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed.

    HighCVSS 7.5No exploitEPSS 1%

    btcpayserver · btcpay serverJan 31, 2023

  • CVE-2021-29246
    26Monitor

    BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achieve code execution.

    MediumCVSS 6.7No exploitEPSS 1%

    btcpayserver · btcpay serverMay 5, 2021

  • CVE-2021-29251
    26Monitor

    BTCPay Server before 1.0.7.1 mishandles the policy setting in which users can register (in Server Settings > Policies).

    MediumCVSS 6.5No exploitEPSS 0%

    btcpayserver · btcpay serverApr 1, 2021

  • CVE-2021-3646
    24Monitor

    Cross-site Scripting (XSS) - Reflected in btcpayserver/btcpayserver

    MediumCVSS 6.1No exploitEPSS 0%

    btcpayserver · btcpay serverSep 10, 2021

  • CVE-2023-0748
    24Monitor

    Open Redirect in btcpayserver/btcpayserver

    MediumCVSS 6.1Proof of conceptEPSS 0%

    btcpayserver · btcpayserverFeb 8, 2023

  • CVE-2021-29247
    21Monitor

    BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for

    MediumCVSS 5.3No exploitEPSS 1%

    btcpayserver · btcpay serverMay 5, 2021

  • CVE-2021-29245
    21Monitor

    BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key.

    MediumCVSS 5.3No exploitEPSS 0%

    btcpayserver · btcpay serverMay 5, 2021

  • CVE-2021-29248
    21Monitor

    BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the Secure flag for a

    MediumCVSS 5.3No exploitEPSS 0%

    btcpayserver · btcpay serverMay 5, 2021

  • CVE-2021-3830
    21Monitor

    Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver

    MediumCVSS 5.4No exploitEPSS 0%

    btcpayserver · btcpay serverSep 26, 2021

  • CVE-2023-0810
    21Monitor

    Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver

    MediumCVSS 5.4No exploitEPSS 0%

    btcpayserver · btcpayserverFeb 13, 2023

  • CVE-2023-1149
    21Monitor

    Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver

    MediumCVSS 5.4No exploitEPSS 0%

    btcpayserver · btcpay serverMar 2, 2023

  • CVE-2021-29250
    21Monitor

    BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting (XSS) vulnerability within the POS Add Products functionality.

    MediumCVSS 5.4No exploitEPSS 0%

    btcpayserver · btcpay serverMay 5, 2021

  • CVE-2023-0747
    21Monitor

    Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver

    MediumCVSS 5.4No exploitEPSS 0%

    btcpayserver · btcpayserverFeb 8, 2023

  • CVE-2023-0879
    21Monitor

    Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver

    MediumCVSS 5.4No exploitEPSS 0%

    btcpayserver · btcpay serverFeb 16, 2023

  • CVE-2023-1270
    21Monitor

    Cross-site Scripting in btcpayserver/btcpayserver

    MediumCVSS 5.4No exploitEPSS 0%

    btcpayserver · btcpayserverMar 8, 2023