Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nevoeiro

15 ℃

88%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 10:30:01

[USD] USD 71,698.60

[BRL] BRL 362,508.14 [USD] USD 71,698.60 [GBP] GBP 53,370.22 [EUR] EUR 61,664.60
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 10:48:32 up 254 days, 19:19, 4 users, load average: 0.00, 0.00, 0.00

[01/06/2026 09:24] Operação mira Prefeitura de SP por elo com dona de filme sobre Bolsonaro - CNN Brasil

[01/06/2026 07:00] As intenções de voto de Lula e Flávio Bolsonaro no 2º turno em nova pesquisa - CartaCapital

[01/06/2026 07:08] Eleições na Colômbia: esquerdista Cepeda e direitista De la Espriella disputarão 2º turno - Correio do Povo

[01/06/2026 04:00] Com três propostas em jogo, Senado decidirá rumo do fim da escala 6x1 - CNN Brasil

[01/06/2026 03:30] Designação de CV e PCC como terroristas pelos EUA faz PT e Moro reeditarem embates - O Globo

[01/06/2026 06:00] Saiba como foi o sétimo dia de julgamento do caso do menino Henry Borel - O Globo

[31/05/2026 13:46] Diácono repreende público após tumulto entre apoiadores de Ciro e Elmano em Barbalha; veja vídeo - O POVO

[01/06/2026 08:00] Concursos e seleções: veja inscrições abertas no Ceará nesta segunda-feira (1º) - Diário do Nordeste

[01/06/2026 05:46] Gilmarpalooza — Dia 1: os corredores do poder em Lisboa - Revista Oeste

[31/05/2026 13:46] Trump devolve proposta de acordo ao Irã com exigências mais duras e prolonga negociações - O Globo

[CVE-2021-47912] [Modified: 12-02-2026] [Analyzed] [V3.1 S6.4:MEDIUM] PHP Melody version 3.0 contains multiple non-persistent cross-site scripting vulnerabilities in categories, import, and user import files. Attackers can inject malicious scripts through unvalidated parameters to execute client-side attacks and potentially hijack user sessions.

[CVE-2021-47913] [Modified: 11-02-2026] [Analyzed] [V3.1 S6.4:MEDIUM] PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts. Attackers can exploit the WYSIWYG editor to execute persistent scripts, potentially leading to session hijacking and application manipulation.

[CVE-2021-47914] [Modified: 11-02-2026] [Analyzed] [V3.1 S6.4:MEDIUM] PHP Melody version 3.0 contains a persistent cross-site scripting vulnerability in the edit-video.php submitted parameter that allows remote attackers to inject malicious script code. Attackers can exploit this vulnerability to execute arbitrary JavaScript, potentially leading to session hijacking, persistent phishing, and manipulation of application modules.

[CVE-2021-47915] [Modified: 11-02-2026] [Analyzed] [V3.1 S8.1:HIGH] PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated attackers to inject malicious SQL commands. Attackers can exploit the unvalidated 'vid' parameter to execute arbitrary database queries and potentially compromise the web application and database management system.

[CVE-2021-47917] [Modified: 11-02-2026] [Analyzed] [V3.1 S6.4:MEDIUM] Simple CMS 2.1 contains a persistent cross-site scripting vulnerability in user input parameters that allows remote attackers to inject malicious script code. Attackers can exploit the newUser and editUser modules to inject persistent scripts that execute on user list preview, potentially leading to session hijacking and application manipulation.

[CVE-2021-47918] [Modified: 11-02-2026] [Analyzed] [V3.1 S8.1:HIGH] Simple CMS 2.1 contains a remote SQL injection vulnerability that allows privileged attackers to inject unfiltered SQL commands in the users module. Attackers can exploit unvalidated input parameters in the admin.php file to compromise the database management system and web application.

[CVE-2021-47919] [Modified: 11-02-2026] [Analyzed] [V3.1 S6.4:MEDIUM] Simple CMS 2.1 contains a non-persistent cross-site scripting vulnerability in the preview.php file's id parameter. Attackers can inject malicious script code through a GET request to execute arbitrary scripts and potentially hijack user sessions or perform phishing attacks.

[CVE-2026-1733] [Modified: 29-04-2026] [Analyzed] [V3.1 S4.3:MEDIUM] A vulnerability was identified in Zhong Bang CRMEB up to 5.6.3. This affects the function detail/tidyOrder of the file /api/store_integral/order/detail/:uni. The manipulation of the argument order_id leads to improper authorization. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2026-25253] [Modified: 13-02-2026] [Analyzed] [V3.1 S8.8:HIGH] OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.

[CVE-2026-1734] [Modified: 11-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] A security flaw has been discovered in Zhong Bang CRMEB up to 5.6.3. This vulnerability affects unknown code of the file crmeb/app/api/controller/v1/CrontabController.php of the component crontab Endpoint. The manipulation results in missing authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2026-1736] [Modified: 11-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] A security vulnerability has been detected in Open5GS up to 2.7.6. Impacted is the function sgwc_s11_handle_create_indirect_data_forwarding_tunnel_request of the file /src/sgwc/s11-handler.c of the component SGWC. Such manipulation leads to reachable assertion. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. A patch should be applied to remediate this issue. The issue report is flagged as already-fixed.

[CVE-2026-1737] [Modified: 11-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] A vulnerability was detected in Open5GS up to 2.7.6. The affected element is the function sgwc_s5c_handle_create_bearer_request of the file /src/sgwc/s5c-handler.c of the component CreateBearerRequest Handler. Performing a manipulation results in reachable assertion. Remote exploitation of the attack is possible. The exploit is now public and may be used. To fix this issue, it is recommended to deploy a patch. The issue report is flagged as already-fixed.

[CVE-2026-1738] [Modified: 11-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] A flaw has been found in Open5GS up to 2.7.6. The impacted element is the function sgwc_tunnel_add of the file /src/sgwc/context.c of the component SGWC. Executing a manipulation of the argument pdr can lead to reachable assertion. The attack can be executed remotely. The exploit has been published and may be used. It is advisable to implement a patch to correct this issue. The issue report is flagged as already-fixed.

[CVE-2026-1739] [Modified: 11-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] A vulnerability has been found in Free5GC pcf up to 1.4.1. This affects the function HandleCreateSmPolicyRequest of the file internal/sbi/processor/smpolicy.go. The manipulation leads to null pointer dereference. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is df535f5524314620715e842baf9723efbeb481a7. Applying a patch is the recommended action to fix this issue.

[CVE-2026-1740] [Modified: 29-04-2026] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was found in EFM ipTIME A8004T 14.18.2. This impacts the function httpcon_check_session_url of the file /cgi/timepro.cgi of the component Hidden Hiddenloginsetup Interface. The manipulation results in improper authentication. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2026-1741] [Modified: 10-03-2026] [Analyzed] [V3.1 S6.6:MEDIUM] A vulnerability was determined in EFM ipTIME A8004T 14.18.2. Affected is the function httpcon_check_session_url of the file /sess-bin/d.cgi of the component Debug Interface. This manipulation of the argument cmd causes backdoor. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2026-1742] [Modified: 29-04-2026] [Analyzed] [V3.1 S4.7:MEDIUM] A vulnerability was identified in EFM ipTIME A8004T 14.18.2. Affected by this vulnerability is the function commit_vpncli_file_upload of the file /cgi/timepro.cgi of the component VPN Service. Such manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2026-1744] [Modified: 29-04-2026] [Analyzed] [V3.1 S2.4:LOW] A vulnerability was found in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function doSubmitPPP of the file sp_pppoe_user.js. The manipulation of the argument Username results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

[CVE-2026-25200] [Modified: 10-03-2026] [Analyzed] [V3.1 S9.8:CRITICAL] A vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without authentication, leading to Stored XSS, which can result in account takeover This issue affects MagicINFO 9 Server: less than 21.1090.1.

[CVE-2026-25201] [Modified: 10-03-2026] [Analyzed] [V3.1 S8.8:HIGH] An unauthenticated user can upload arbitrary files to execute remote code, leading to privilege escalation in MagicInfo9 Server. This issue affects MagicINFO 9 Server: less than 21.1090.1.