Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu limpo

25 ℃

78%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 02:00:02

[USD] USD 87,405.86

[BRL] BRL 484,604.30 [USD] USD 87,405.86 [GBP] GBP 64,745.10 [EUR] EUR 74,239.48
Price index provided by blockchain.info.
Disclosure of the details of a bug on 32-bit systems which may, in a rare edge case, cause the node to crash when receiving a pathological block. This bug would be extremely hard to exploit. A fix was released on October 10th 2025 in Bitcoin Core v30.0.
This issue is considered Low severity.

Details
Before writing a block to disk, Bitcoin Core checks that its size is within a normal range. This check would overflow on 32-bit systems for blocks over 1GB, and make the node crash when writing it to disk. Such a block cannot be sent using the BLOCK message, but could in theory be sent as a compact block if the victim node has a non-default large mempool which already contains 1GB of transactions. This would require the victim to have set their -maxmempool option to a value greater than 3GB, while 32-bit systems may have at most 4GiB of memory.
This issue was indirectly prevented by capping the maximum value of the -maxmempool setting on 32-bit systems.

Attribution
Pieter Wuille discovered this bug and disclosed it responsibly.
Antoine Poinsot proposed and implemented a covert mitigation.

Timeline
- 2025-04-24 - Pieter Wuille reports the issue
- 2025-05-16 - Antoine Poinsot opens PR #32530 with a covert fix
- 2025-06-26 - PR #32530 is merged into master
- 2025-09-04 - Version 29.1 is released with the fix
- 2025-10-10 - Version 30.0 is released with the fix
- 2025-10-24 - Public Disclosure

dog - 02:20:25 up 98 days, 10:51, 8 users, load average: 0.02, 0.03, 0.00

[26/12/2025 20:23] Polícia do Paraguai entrega Silvinei Vasques às autoridades brasileiras - O Globo

[26/12/2025 16:09] Bolsonaro inicia reabilitação pós-operatória - Agência Brasil

[26/12/2025 17:07] Defesa Civil alerta para temporais no interior de SP; governo mobiliza gabinete de crise - G1

[26/12/2025 16:33] ATENÇÃO – 26/12 12:09 – TEMPORAIS com RAIOS, RAJADAS DE VENTO, GRANIZO e ALAGAMENTOS nas próximas 2 horas. Ocorrências ligue 199 ou 193. - Secretaria de Estado da Proteção e Defesa Civil

[26/12/2025 17:50] Castro sanciona lei que autoriza o RJ a aderir ao Propag, programa de refinanciamento da dívida - G1

[26/12/2025 18:04] AGU derruba liminar que suspendeu novas regras para CNH - Agência Brasil

[26/12/2025 15:17] Mônica Bergamo: Master arrasta STF de forma inédita para o centro da crise e eleva tensão em Brasília e SP - Folha de S.Paulo

[26/12/2025 13:13] Bloqueio atmosférico causa alerta de calor em oito estados - Agência Brasil

[26/12/2025 17:39] “Difícil não perder a fé na humanidade", diz Janja após morte de Tainara - CNN Brasil

[26/12/2025 12:12] Final da semana no Rio Grande do Sul terá avanço de frente fria com tempestades isoladas, granizo e rajadas de vento - Portal do Estado do Rio Grande do Sul

[CVE-2025-9601] [Modified: 02-09-2025] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was detected in itsourcecode Apartment Management System 1.0. This affects an unknown part of the file /setting/employee_salary_setup.php. The manipulation of the argument ddlEmpName results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

[CVE-2025-9602] [Modified: 11-09-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was found in Xinhu RockOA up to 2.6.9. Impacted is the function publicsaveAjax of the file /index.php. Performing manipulation results in improper authorization. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

[CVE-2025-9603] [Modified: 11-09-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was determined in Telesquare TLR-2005KSH 1.2.4. The affected element is an unknown function of the file /cgi-bin/internet.cgi?Command=lanCfg. Executing manipulation of the argument Hostname can lead to command injection. The attack may be performed from a remote location. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-58323] [Modified: 16-10-2025] [Analyzed] [V3.1 S7.7:HIGH] NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by executing arbitrary files due to improper privilege checks.

[CVE-2025-9605] [Modified: 03-09-2025] [Analyzed] [V3.1 S9.8:CRITICAL] A security vulnerability has been detected in Tenda AC21 and AC23 16.03.08.16. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. Such manipulation of the argument mac leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

[CVE-2025-9606] [Modified: 02-09-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/agenda_preferencias.php. Performing manipulation of the argument cod_agenda results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.

[CVE-2025-9607] [Modified: 02-09-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A flaw has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/TabelaArredondamento/view of the component Tabelas de Arredondamento Page. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.

[CVE-2025-9608] [Modified: 02-09-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/FormulaMedia/view of the component Formula de Cálculo de Média Page. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

[CVE-2025-9609] [Modified: 04-09-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /educacenso/consulta. The manipulation results in improper authorization. The attack can be executed remotely. The exploit has been made public and could be used.

[CVE-2025-9610] [Modified: 13-11-2025] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was determined in code-projects Online Event Judging System 1.0. This issue affects some unknown processing of the file /create_account.php. This manipulation of the argument fname causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Other parameters might be affected as well.

[CVE-2024-13342] [Modified: 08-12-2025] [Analyzed] [V3.1 S8.1:HIGH] The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_files_to_order' function in all versions up to, and including, 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files with double extensions on the affected site's server which may make remote code execution possible. This is only exploitable on select instances where the configuration will execute the first extension present.

[CVE-2025-40702] [Modified: 02-09-2025] [Analyzed] [V3.1 S5.4:MEDIUM] Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/file" petition, "creator" and "license_holder" parameters.

[CVE-2025-40703] [Modified: 02-09-2025] [Analyzed] [V3.1 S5.4:MEDIUM] Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/group" petition, "name" and "alias-0” parameters.

[CVE-2025-40704] [Modified: 02-09-2025] [Analyzed] [V3.1 S5.4:MEDIUM] Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/edition" petition, "name" parameter.

[CVE-2025-40705] [Modified: 02-09-2025] [Analyzed] [V3.1 S5.4:MEDIUM] Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/acquisition" petition, "name" parameter.

[CVE-2025-40706] [Modified: 02-09-2025] [Analyzed] [V3.1 S5.4:MEDIUM] Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/source" petition, "name" parameter.

[CVE-2025-40707] [Modified: 02-09-2025] [Analyzed] [V3.1 S5.4:MEDIUM] Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/place" petition, "name" and "alias-0” parameters.

[CVE-2025-40708] [Modified: 02-09-2025] [Analyzed] [V3.1 S5.4:MEDIUM] Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/event" petition, "name" parameter.

[CVE-2025-40709] [Modified: 02-09-2025] [Analyzed] [V3.1 S5.4:MEDIUM] Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/person/<ID>” petition, "name" and "alias-0” parameters.

[CVE-2025-9643] [Modified: 02-09-2025] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was found in itsourcecode Apartment Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /setting/utility_bill_setup.php. Performing manipulation of the argument txtGasBill results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.