Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu limpo

12 ℃

91%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 00:30:01

[USD] USD 81,071.56

[BRL] BRL 398,134.32 [USD] USD 81,071.56 [GBP] GBP 59,896.56 [EUR] EUR 69,086.59
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 00:39:30 up 235 days, 9:10, 3 users, load average: 0.00, 0.00, 0.00

[12/05/2026 18:50] A cinco meses das eleições, Lula anuncia fim da 'taxa das blusinhas', cobrança de 20% sobre compras internacionais - O Globo

[12/05/2026 11:27] Nunes Marques assume presidência do TSE com festa a R$ 800 o convite - Correio Braziliense

[12/05/2026 16:41] O que se sabe sobre veto da UE à importação de carne bovina do Brasil a partir de setembro - CartaCapital

[12/05/2026 20:21] Quem poderá renovar a CNH automaticamente? Veja as regras - CNN Brasil

[12/05/2026 18:43] Prefeitura do Rio encerra pagamento de passagens de ônibus municipais em dinheiro - Extra online

[12/05/2026 17:16] R$ 650 mil no Pix: Marqueteiro de Flávio Bolsonaro aparece em plano de Vorcaro para atacar BC - Revista Fórum

[12/05/2026 13:18] Lula diz ter pedido a Trump para entregar criminosos brasileiros nos EUA - CNN Brasil

[12/05/2026 18:51] Acidente no Anel Rodoviário causa congestionamento em BH; veja fotos - Estado de Minas

[12/05/2026 19:38] PL escanteia Simões e decide construir aliança com Republicanos em Minas - Estado de Minas

[12/05/2026 16:16] Em meio a greve da USP, deputado do MBL protocola PL que pode impedir estudantes de ingressar na universidade - CartaCapital

[CVE-2026-0492] [Modified: 27-01-2026] [Analyzed] [V3.1 S8.8:HIGH] SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This exploit could result in a total compromise of the system�s confidentiality, integrity, and availability.

[CVE-2026-0498] [Modified: 22-01-2026] [Analyzed] [V3.1 S9.1:CRITICAL] SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.

[CVE-2026-0500] [Modified: 22-01-2026] [Analyzed] [V3.1 S9.6:CRITICAL] Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malicious JNLP (Java Network Launch Protocol) file accessible by a public facing URL. When a victim clicks on the URL the accessed Wily Introscope Server could execute OS commands on the victim's machine. This could completely compromising confidentiality, integrity and availability of the system.

[CVE-2026-0506] [Modified: 22-01-2026] [Analyzed] [V3.1 S8.1:HIGH] Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to execute form routines (FORMs) in the ABAP system. Successful exploitation could allow the attacker to write or modify data accessible via FORMs and invoke system functionality exposed via FORMs, resulting in a high impact on integrity and availability, while confidentiality remains unaffected.

[CVE-2026-0513] [Modified: 22-01-2026] [Analyzed] [V3.1 S4.7:MEDIUM] Due to an Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirects them to an attacker-controlled site.This causes low impact on integrity of the application. Confidentiality and availability are not impacted.

[CVE-2026-0514] [Modified: 16-01-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Due to a Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious link. When an unsuspecting user clicks this link, the user may be redirected to a site controlled by the attacker. Successful exploitation could allow the attacker to access or modify information related to the webclient, impacting confidentiality and integrity, with no effect on availability.

[CVE-2025-40942] [Modified: 22-01-2026] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.4). Affected application contains a local privilege escalation vulnerability that could allow an attacker to run arbitrary code with elevated privileges.

[CVE-2025-59020] [Modified: 14-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

[CVE-2025-59021] [Modified: 14-01-2026] [Analyzed] [V3.1 S6.4:MEDIUM] Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any redirect record without restriction to the user’s own file-mounts or web-mounts. This allowed attackers to insert or alter redirects pointing to arbitrary URLs – facilitating phishing or other malicious redirect attacks. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

[CVE-2025-59022] [Modified: 14-01-2026] [Analyzed] [V3.1 S8.1:HIGH] Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

[CVE-2026-0859] [Modified: 14-01-2026] [Analyzed] [V3.1 S7.8:HIGH] TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

[CVE-2025-13774] [Modified: 05-02-2026] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.4 and 13.0.1 where an SQL injection vulnerability allows authenticated users to execute unintended SQL queries and commands.

[CVE-2025-11250] [Modified: 29-01-2026] [Analyzed] [V3.1 S9.1:CRITICAL] Zohocorp ManageEngine ADSelfService Plus versions before 6519 are vulnerable to Authentication Bypass due to improper filter configurations.

[CVE-2025-11669] [Modified: 02-02-2026] [Analyzed] [V3.1 S8.1:HIGH] Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an authorization issue in the initiate remote session functionality.

[CVE-2025-9435] [Modified: 29-01-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Zohocorp ManageEngine ADManager Plus versions below 7230 are vulnerable to Path Traversal in the User Management module

[CVE-2025-13444] [Modified: 13-02-2026] [Analyzed] [V3.1 S8.4:HIGH] OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters

[CVE-2025-13447] [Modified: 10-02-2026] [Analyzed] [V3.1 S8.4:HIGH] OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters

[CVE-2025-55462] [Modified: 05-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response along with Access-Control-Allow-Credentials: true. This permits malicious third-party websites to perform authenticated cross-origin requests against the Eramba API, including endpoints like /system-api/login and /system-api/user/me. The response includes sensitive user session data (ID, name, email, access groups), which is accessible to the attacker's JavaScript. This flaw enables full session hijack and data exfiltration without user interaction. Eramba versions 3.23.3 and earlier were tested and appear unaffected. The vulnerability is present in default installations, requiring no custom configuration.

[CVE-2024-54855] [Modified: 10-02-2026] [Analyzed] [V3.1 S6.4:MEDIUM] fabricators Ltd Vanilla OS 2 Core image v1.1.0 was discovered to contain static keys for the SSH service, allowing attackers to possibly execute a man-in-the-middle attack during connections with other hosts.

[CVE-2025-65783] [Modified: 05-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] An arbitrary file upload vulnerability in the /utils/uploadFile component of Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows attackers to execute arbitrary code via uploading a crafted PDF file.