Antoine Poinsot

**Name of the Vulnerable Software and Affected Versions** Ledger Bitcoin app versions 2.1.0 through 2.1.1 **Description** An address derivation issue exists due to the improper handling of miniscript policies containing the `a:` fragment. Attackers can craft malicious miniscript policies that cause the device to derive and display incorrect receiving addresses, which could lead to funds being sent to unintended addresses. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** BTCPay Server versions 1.3.0 through 1.5.3 **Description** The issue allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed. This sensitive information, found in the HTML source code, includes the `xpub` of the store. Additionally, if the store is not using the internal lightning node, the credentials of a lightning node are exposed. **Recommendations** For BTCPay Server versions 1.3.0 through 1.5.3, consider restricting access to the public Point of Sale app to minimize the risk of sensitive information exposure. As a temporary workaround, review the HTML source code to ensure no sensitive data is inadvertently exposed. Restrict access to the `xpub` of the store and lightning node credentials until a patch is available.