Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu limpo

18 ℃

95%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 04:00:01

[USD] USD 75,706.48

[BRL] BRL 380,985.27 [USD] USD 75,706.48 [GBP] GBP 56,280.12 [EUR] EUR 65,011.88
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 04:14:02 up 249 days, 12:45, 4 users, load average: 0.00, 0.01, 0.00

[26/05/2026 19:13] Flávio Bolsonaro visita Casa Branca e diz que pediu a Trump para classificar PCC e CV como terroristas - CartaCapital

[26/05/2026 17:33] Operação da PF contra Cláudio Castro provoca tensão na Alerj e amplia temor eleitoral na base governista - O GLOBO

[26/05/2026 19:04] Flávio tem muitas questões a explicar, diz Tarcísio sobre visita a Vorcaro - CNN Brasil

[26/05/2026 18:28] Mulher é resgatada em Ilhabela após passar dois dias à deriva em alto-mar - Jovem Pan

[26/05/2026 22:28] Fim da escala 6X1 será repassado aos produtos, dizem empresários no Senado - UOL Economia

[26/05/2026 16:45] Monique Medeiros sabia de agressões contra Henry Borel, afirma delegado - Revista Oeste

[26/05/2026 14:09] Mulher jogada de penhasco na Serra do Rola-Moça não teve ferimentos graves - Rádio Itatiaia

[26/05/2026 17:44] Senado aprova piso de R$ 5.130 para professores e nova regra de reajuste — Senado Notícias - Senado Federal

[26/05/2026 18:06] Após carta de Deolane, Daniele vai a penitenciária - Metrópoles

[26/05/2026 11:26] Líder do Irã diz que países do Golfo não vão mais abrigar bases dos EUA - Poder360

[CVE-2026-1361] [Modified: 17-02-2026] [Analyzed] [V3.1 S7.8:HIGH] ASDA-Soft Stack-based Buffer Overflow Vulnerability

[CVE-2026-21720] [Modified: 17-02-2026] [Analyzed] [V3.1 S7.5:HIGH] Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.

[CVE-2026-21721] [Modified: 20-04-2026] [Analyzed] [V3.1 S8.1:HIGH] The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.

[CVE-2026-24793] [Modified: 17-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in azerothcore azerothcore-wotlk (deps/zlib modules). This vulnerability is associated with program files inflate.C. This issue affects azerothcore-wotlk: through v4.0.0.

[CVE-2026-1467] [Modified: 25-03-2026] [Analyzed] [V3.1 S5.8:MEDIUM] A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to create the Host header. A remote attacker can exploit this by providing a specially crafted URL containing CRLF sequences, allowing them to inject additional HTTP headers or complete HTTP request bodies. This can lead to unintended or unauthorized HTTP requests being forwarded by the proxy, potentially impacting downstream services.

[CVE-2026-21417] [Modified: 06-02-2026] [Analyzed] [V3.1 S7.0:HIGH] Dell CloudBoost Virtual Appliance, versions prior to 19.14.0.0, contains a Plaintext Storage of Password vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

[CVE-2026-24345] [Modified: 05-02-2026] [Analyzed] [V3.1 S8.8:HIGH] Cross-Site Request Forgery in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to bypass authorization checks and gain full access to the admin UI

[CVE-2026-24346] [Modified: 05-02-2026] [Analyzed] [V3.1 S9.1:CRITICAL] Use of well-known default credentials in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to access protected areas in the web application

[CVE-2026-24347] [Modified: 05-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] Improper input validation in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to manipulate files in the /tmp directory

[CVE-2026-24348] [Modified: 05-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Multiple cross-site scripting vulnerabilities in Admin UI of EZCast Pro II version 1.17478.146 allow attackers to execute arbitrary JavaScript code in the browser of other Admin UI users.

[CVE-2026-1213] [Modified: 14-04-2026] [Analyzed] [V3.1 S4.3:MEDIUM] All versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other application users.This issue affects askbot: 0.12.2.

[CVE-2026-1470] [Modified: 20-02-2026] [Analyzed] [V3.1 S9.9:CRITICAL] n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations.

[CVE-2020-36941] [Modified: 24-03-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Knockpy 4.1.1 contains a CSV injection vulnerability that allows attackers to inject malicious formulas into CSV reports through unfiltered server headers. Attackers can manipulate server response headers to include spreadsheet formulas that will execute when the CSV is opened in spreadsheet applications.

[CVE-2020-36942] [Modified: 10-02-2026] [Analyzed] [V3.1 S8.8:HIGH] Victor CMS 1.0 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the profile image upload feature. Attackers can upload a PHP shell to the /img directory and execute system commands by accessing the uploaded file via web browser.

[CVE-2020-36946] [Modified: 24-03-2026] [Analyzed] [V3.1 S7.5:HIGH] SyncBreeze 10.0.28 contains a denial of service vulnerability in the login endpoint that allows remote attackers to crash the service. Attackers can send an oversized payload in the login request to overwhelm the application and potentially disrupt service availability.

[CVE-2020-36947] [Modified: 02-02-2026] [Analyzed] [V3.1 S7.1:HIGH] LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database information. Attackers can exploit the vulnerability by manipulating the 'sort' parameter with crafted SQL injection techniques to retrieve sensitive database contents through time-based blind SQL injection.

[CVE-2020-36949] [Modified: 20-02-2026] [Analyzed] [V3.1 S7.5:HIGH] TapinRadio 2.13.7 contains a denial of service vulnerability in the application proxy settings that allows attackers to crash the program by overflowing input fields. Attackers can paste a large buffer of 20,000 characters into the username and address fields to cause the application to become unresponsive and require reinstallation.

[CVE-2025-15467] [Modified: 07-05-2026] [Analyzed] [V3.1 S8.8:HIGH] Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.

[CVE-2025-15468] [Modified: 02-02-2026] [Analyzed] [V3.1 S5.9:MEDIUM] Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. Impact summary: A NULL pointer dereference leads to abnormal termination of the running process causing Denial of Service. Some applications call SSL_CIPHER_find() from the client_hello_cb callback on the cipher ID received from the peer. If this is done with an SSL object implementing the QUIC protocol, NULL pointer dereference will happen if the examined cipher ID is unknown or unsupported. As it is not very common to call this function in applications using the QUIC protocol and the worst outcome is Denial of Service, the issue was assessed as Low severity. The vulnerable code was introduced in the 3.2 version with the addition of the QUIC protocol support. The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue, as the QUIC implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue. OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.

[CVE-2025-15469] [Modified: 02-02-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of an error. Impact summary: A user signing or verifying files larger than 16MB with one-shot algorithms (such as Ed25519, Ed448, or ML-DSA) may believe the entire file is authenticated while trailing data beyond 16MB remains unauthenticated. When the 'openssl dgst' command is used with algorithms that only support one-shot signing (Ed25519, Ed448, ML-DSA-44, ML-DSA-65, ML-DSA-87), the input is buffered with a 16MB limit. If the input exceeds this limit, the tool silently truncates to the first 16MB and continues without signaling an error, contrary to what the documentation states. This creates an integrity gap where trailing bytes can be modified without detection if both signing and verification are performed using the same affected codepath. The issue affects only the command-line tool behavior. Verifiers that process the full message using library APIs will reject the signature, so the risk primarily affects workflows that both sign and verify with the affected 'openssl dgst' command. Streaming digest algorithms for 'openssl dgst' and library users are unaffected. The FIPS modules in 3.5 and 3.6 are not affected by this issue, as the command-line tools are outside the OpenSSL FIPS module boundary. OpenSSL 3.5 and 3.6 are vulnerable to this issue. OpenSSL 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are not affected by this issue.