111 matches found
WS-2021-0183
BTCPay Server before 1.0.7.1 forget password page was not properly rate-limiting the attempts, resulting in a malicious user mail bombard the victim with forget password emails...
BTCPay Server Cross-Site Scripting Vulnerability (CNVD-2021-34112)
BTCPay Server is a self-hosted open source cryptocurrency payment processor. It is secure, private, uncensored and free. A cross-site scripting vulnerability exists in BTCPay Server 1.0.7.0 and earlier versions. The vulnerability stems from a failure to set a security flag for a cookie. An attack...
BTCPay Server Cross-Site Scripting Vulnerability (CNVD-2021-34111)
BTCPay Server is a self-hosted open source cryptocurrency payment processor. It is secure, private, uncensored and free. A cross-site scripting vulnerability exists in BTCPay Server version 1.0.7.0 and prior versions, which stems from a weak method Next to generate pseudo-random values to generat...
BTCPay Server Cross-Site Scripting Vulnerability (CNVD-2021-34110)
BTCPay Server is a self-hosted open source cryptocurrency payment processor. It is secure, private, uncensored and free. A stored cross-site scripting vulnerability exists in the "POS Add Products" feature in BTCPay Server 1.0.7.0 and earlier versions. An attacker could exploit this vulnerability...
BTCPay Server Cross-Site Scripting Vulnerability
BTCPay Server is a self-hosted open source cryptocurrency payment processor. It is secure, private, uncensored and free. A cross-site scripting vulnerability exists in BTCPay Server 1.0.7.0 and earlier versions. The vulnerability stems from a failure to set the HTTPOnly flag for cookies. An...
BTCPay Server Path Traversal Vulnerability
BTCPay Server is a self-hosted open source cryptocurrency payment processor. It is secure, private, uncensored and free. A path traversal vulnerability exists in BTCPay Server version 1.0.7.0 and prior versions, which arises from a failure of a networked system or product to properly filter speci...
CVE-2021-29245
BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key...
CVE-2021-29245
BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key...
CVE-2021-29248
BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the Secure flag for a cookie...
CVE-2021-29247
BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for a cookie...
CVE-2021-29248
BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the Secure flag for a cookie...
CVE-2021-29250
BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting XSS vulnerability within the POS Add Products functionality. This enables cookie stealing...
CVE-2021-29246
BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achieve code execution. The attacker must craft a malicious plugin file with special characters to upload the file outside of the restricted directory...
CVE-2021-29250
BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting XSS vulnerability within the POS Add Products functionality. This enables cookie stealing...
CVE-2021-29247
BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for a cookie...
CVE-2021-29246
BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achieve code execution. The attacker must craft a malicious plugin file with special characters to upload the file outside of the restricted directory...
Design/Logic Flaw
BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key...
Information disclosure
BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for a cookie...