Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu limpo

15 ℃

95%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 03:30:01

[USD] USD 60,407.08

[BRL] BRL 314,533.61 [USD] USD 60,407.08 [GBP] GBP 45,437.90 [EUR] EUR 53,045.27
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 03:41:29 up 285 days, 12:12, 6 users, load average: 0.00, 0.00, 0.00

[01/07/2026 19:36] PGR se manifesta pela manutenção de prisão domiciliar de Bolsonaro - Correio Braziliense

[01/07/2026 18:33] Sindicato decide suspender greve de motoristas de ônibus no Rio - CNN Brasil

[01/07/2026 19:11] Aliada de Michelle, vereadora pivô de rompimento na família Bolsonaro declara apoio a Flavio: 'Fidelidade e compromisso' - O GLOBO

[01/07/2026 21:57] Rússia faz mega-ataque contra Kiev; Polônia mobiliza caças - 01/07/2026 - Mundo - Folha de S.Paulo

[01/07/2026 21:39] Quem são os brasileiros na mira dos EUA por suspeita de ligação com o PCC - Poder360

[01/07/2026 19:46] Flávio chama Michelle de “desinformada” após fala sobre Vorcaro - Poder360

[01/07/2026 20:21] Advogado e empresária são mortos a facadas em apartamento de bairro nobre em BH; diarista é suspeita - Estadão

[01/07/2026 10:53] Como católicos e evangélicos votariam para presidente no 1º turno, segundo pesquisa AtlasIntel - CartaCapital

[01/07/2026 14:44] Alcolumbre sugeriu reduzir transição da PEC da 6 X 1, diz Paim - Poder360

[01/07/2026 20:26] Lula diz que crescimento de ilha na Bahia pode atrair crime organizado - Poder360

[CVE-2026-2994] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.8:MEDIUM] Concrete CMS below version 9.4.8 is subject to CSRF by a Rogue Administrator using the Anti-Spam Allowlist Group Configuration via group_id parameter which can leads to a security bypass since changes are saved prior to checking the CSRF token. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks z3rco for reporting

[CVE-2026-3240] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.8:MEDIUM] In Concrete CMS below version 9.4.8, a user with permission to edit a page with element Legacy form can perform a stored XSS attack towards high-privilege accounts via the Question field. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Thanks minhnn42, namdi and quanlna2 from VCSLab-Viettel Cyber Security for reporting.

[CVE-2026-3241] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.8:MEDIUM] In Concrete CMS below version 9.4.8, a stored cross-site scripting (XSS) vulnerability exists in the "Legacy Form" block. An authenticated user with permissions to create or edit forms (e.g., a rogue administrator) can inject a persistent JavaScript payload into the options of a multiple-choice question (Checkbox List, Radio Buttons, or Select Box). This payload is then executed in the browser of any user who views the page containing the form. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks M3dium for reporting.

[CVE-2026-3242] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.8:MEDIUM] In Concrete CMS below version 9.4.8, a rogue administrator can add stored XSS via the Switch Language block. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks M3dium for reporting.

[CVE-2026-28769] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] A path traversal vulnerability exists in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management portal version 101. An authenticated attacker can manipulate the `file` parameter to traverse directories and enumerate arbitrary files on the underlying filesystem. Due to the insecure perl file path handling function in use, a authenticated actor is able to preform directory traversal, with the backup endpoint confirming a file exists by indicating that a backup operation was successful or when using the path of a non existent file, the returned status is failed.

[CVE-2026-28770] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] Improper neutralization of special elements in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management Interface version 101 allows for XML Injection. The application reflects un-sanitized user input from the `file` parameter directly into a CDATA block, allowing an authenticated attacker to break out of the tags and inject arbitrary XML elements. An actor is confirmed to be able to turn this into an reflected XSS but further abuse such as XXE may be possible

[CVE-2026-28771] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.1:MEDIUM] A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /index.cgi endpoint of International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101. The application fails to adequately sanitize user-supplied input provided via the `cat` parameter before reflecting it in the HTTP response, allowing a remote attacker to execute arbitrary HTML or JavaScript in the victim's browser context.

[CVE-2026-28772] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.1:MEDIUM] A Reflected Cross-Site Scripting (XSS) vulnerability in the /IDC_Logging/index.cgi endpoint of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101 allows a remote attacker to execute arbitrary web scripts or HTML. The vulnerability is triggered by sending a crafted payload through the `submitType` parameter, which is reflected directly into the DOM without proper escaping.

[CVE-2026-28773] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] The web-based Ping diagnostic utility (/IDC_Ping/main.cgi) in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101 is vulnerable to OS Command Injection. The application insecurely parses the `IPaddr` parameter. An authenticated attacker can bypass server-side semicolon exclusion checks by using alternate shell metacharacters (such as the pipe `|` operator) to append and execute arbitrary shell commands with root privileges.

[CVE-2026-28774] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101. An authenticated attacker can inject arbitrary shell metacharacters (such as the pipe `|` operator) into the flags parameter, leading to the execution of arbitrary operating system commands with root privileges.

[CVE-2026-28775] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver. The deployment insecurely provisions the `private` SNMP community string with read/write access by default. Because the SNMP agent runs as root, an unauthenticated remote attacker can utilize `NET-SNMP-EXTEND-MIB` directives, abusing the fact that the system runs a vulnerable version of net-snmp pre 5.8, to execute arbitrary operating system commands with root privileges.

[CVE-2026-28776] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver contains hardcoded credentials for the `monitor` account. A remote unauthenticated attacker can use these trivial, undocumented credentials to access the system via SSH. While initially dropped into a restricted shell, the attacker can trivially break out to achieve standard shell functionality.

[CVE-2026-28777] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] International Datacasting Corporation (IDC) SFX2100 Satellite Receiver, trivial password for the `user` (usr) account. A remote unauthenticated attacker can exploit this to gain unauthorized SSH access to the system, while intially dropped into a restricted shell, an attacker can trivially spawn a complete pty to gain an appropriately interactive shell.

[CVE-2026-28778] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver contains undocumented, hardcoded/insecure credentials for the `xd` user account. A remote unauthenticated attacker can log in via FTP using these credentials. Because the `xd` user has write permissions to their home directory where root-executed binaries and symlinks (such as those invoked by `xdstartstop`) are stored, the attacker can overwrite these files or manipulate symlinks to achieve arbitrary code execution as the root user.

[CVE-2026-29119] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] International Datacasting Corporation (IDC) SFX Series SuperFlex(SFX2100) SatelliteReceiver contains hardcoded and insecure credentials for the `admin` account. A remote unauthenticated attacker can use these undocumented credentials to access the satellite system directly via the Telnet service, leading to potential system compromise.

[CVE-2026-29120] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.8:HIGH] The /root/anaconda-ks.cfg installation configuration file in International Datacasting Corporation (IDC) SFX Series(SFX2100) SuperFlex Satellite Receiver insecurely stores the hardcoded root password hash. The password itself is highly insecure and susceptible to offline dictionary attacks using the rockyou.txt wordlist. Because direct root SSH login is disabled, an attacker must first obtain low-privileged access to the system (e.g., via other vulnerabilities) to be able to log in as the root user. The password is hardcoded and so allows for an actor with local access on effected versions to escalate to root

[CVE-2026-27441] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] SEPPmail Secure Email Gateway before version 15.0.1 insufficiently neutralizes the PDF encryption password, allowing OS command execution.

[CVE-2026-27442] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] The GINA web interface in SEPPmail Secure Email Gateway before version 15.0.1 does not properly check attachment filenames in GINA-encrypted emails, allowing an attacker to access files on the gateway.

[CVE-2026-27443] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] SEPPmail Secure Email Gateway before version 15.0.1 does not properly sanitize the headers from S/MIME protected MIME entities, allowing an attacker to control trusted headers.

[CVE-2026-27444] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] SEPPmail Secure Email Gateway before version 15.0.1 incorrectly interprets email addresses in the email headers, causing an interpretation conflict with other mail infrastructure that allows an attacker to fake the source of the email or decrypt it.