Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nublado

13 ℃

97%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 16:30:01

[USD] USD 59,707.87

[BRL] BRL 311,663.16 [USD] USD 59,707.87 [GBP] GBP 45,375.12 [EUR] EUR 52,588.61
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 16:33:14 up 278 days, 1:04, 6 users, load average: 0.00, 0.00, 0.00

[24/06/2026 11:24] Moraes manda PGR analisar se arma apreendida de Bolsonaro é 'falta grave' na prisão domiciliar - G1

[24/06/2026 03:56] Digimais: Entenda esquema de gestão fraudulenta investigado pela PF - CNN Brasil

[24/06/2026 06:34] Keiko Fujimori tem vantagem irreversível no Peru na eleição presidencial - Poder360

[24/06/2026 15:40] STM nega ação de Bolsonaro para tirar ministro em caso de perda de patente - UOL Notícias

[24/06/2026 11:30] Eleições na Colômbia: Cepeda admite derrota para De la Espriella - CNN Brasil

[24/06/2026 08:57] Flávio compara Lula a Biden e confirma ida aos EUA contra taxas - Poder360

[24/06/2026 11:18] Quem era o pintor de Volta Redonda morto em chacina em MG - G1

[24/06/2026 11:40] Filho do ex-prefeito foragido Bebeto de Choró é preso pela PF - O POVO

[24/06/2026 12:55] PF investiga sacola com "grana" para Ciro Nogueira; veja VÍDEO - Diário do Centro do Mundo

[24/06/2026 15:12] PT testa 4 nomes para candidatura própria ao governo de MG - Poder360

[CVE-2025-14577] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to execute arbitrary PHP commands by sending specially crafted requests to /webcti/session_ajax.php endpoint. This issue was fixed in version 1.24.0190 (Slican NCP) and 6.61.0010 (Slican IPL/IPM/IPU).

[CVE-2026-1772] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.3:MEDIUM] RTU500 web interface: An unprivileged user can read user management information. The information cannot be accessed via the RTU500 web user interface but requires further tools like browser development utilities to access them without required privileges.

[CVE-2026-23969] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue.

[CVE-2026-23980] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.

[CVE-2026-23982] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.

[CVE-2026-23983] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default)

[CVE-2026-23984] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.

[CVE-2026-2459] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.1:HIGH] A vulnerability exists in REB500 for an authenticated user with Installer role to access and alter the contents of directories that the role is not authorized to do so.

[CVE-2026-2460] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.1:HIGH] A vulnerability exists in REB500 for an authenticated user with low-level privileges to access and alter the content of directories by using the DAC protocol that the user is not authorized to do so.

[CVE-2026-0399] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.9:MEDIUM] Multiple post-authentication stack-based buffer overflow vulnerabilities in the SonicOS management interface due to improper bounds checking in a API endpoint.

[CVE-2026-0400] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.9:MEDIUM] A post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall.

[CVE-2026-0401] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.9:MEDIUM] A post-authentication NULL Pointer Dereference vulnerability in SonicOS allows a remote attacker to crash a firewall.

[CVE-2026-0402] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.9:MEDIUM] A post-authentication Out-of-bounds Read vulnerability in SonicOS allows a remote attacker to crash a firewall.

[CVE-2026-27208] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.2:CRITICAL] bleon-ethical/api-gateway-deploy provides API gateway deployment. Version 1.0.0 is vulnerable to an attack chain involving OS Command Injection and Privilege Escalation. This allows an attacker to execute arbitrary commands with root privileges within the container, potentially leading to a container escape and unauthorized infrastructure modifications. This is fixed in version 1.0.1 by implementing strict input sanitization and secure delimiters in entrypoint.sh, enforcing a non-root user (appuser) in the Dockerfile, and establishing mandatory security quality gates.

[CVE-2026-27483] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. The vulnerability exists in the "Upload File" module, which corresponds to the API endpoint /api/files. Since the multipart file upload does not perform security checks on the uploaded file path, an attacker can perform path traversal by using `../` sequences in the filename field. The file write operation occurs before calling clear_filename and save_file, meaning there is no filtering of filenames or file types, allowing arbitrary content to be written to any path on the server. Version 25.9.1.1 patches the issue.

[CVE-2026-27567] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Payload's external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects could allow an authenticated attacker to access internal network resources. The Payload environment must have at least one collection with `upload` enabled and a user who has `create` access to that upload-enabled collection in order to be vulnerable. An authenticated user with upload collection write permissions could potentially access internal services. Response content from internal services could be retrieved through the application. This vulnerability has been patched in v3.75.0. As a workaround, one may mitigate this vulnerability by disabling external file uploads via the `disableExternalFile` upload collection option, or by restricting `create` access on upload-enabled collections to trusted users only.

[CVE-2026-27568] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.1:MEDIUM] WWBN AVideo is an open source video platform. Prior to version 21.0, AVideo allows Markdown in video comments and uses Parsedown (v1.7.4) without Safe Mode enabled. Markdown links are not sufficiently sanitized, allowing `javascript:` URIs to be rendered as clickable links. An authenticated low-privilege attacker can post a malicious comment that injects persistent JavaScript. When another user clicks the link, the attacker can perform actions such as session hijacking, privilege escalation (including admin takeover), and data exfiltration. Version 21.0 contains a fix. As a workaround, validate and block unsafe URI schemes (e.g., `javascript:`) before rendering Markdown, and enable Parsedown Safe Mode.

[CVE-2026-27584] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows any unauthenticated user to query the SimpleFIN and Pluggy.ai integration endpoints and read sensitive bank account balance and transaction information. This vulnerability allows an unauthenticated attacker to read the bank account balance and transaction history of ActualBudget users. This vulnerability impacts all ActualBudget Server users with the SimpleFIN or Pluggy.ai integrations configured. The ActualBudget Server instance must be reachable over the network. Version 26.2.1 patches the issue.

[CVE-2026-27732] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.1:HIGH] WWBN AVideo is an open source video platform. Prior to version 22.0, the `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger server-side requests to arbitrary URLs (including internal network endpoints). An authenticated attacker can leverage SSRF to interact with internal services and retrieve sensitive data (e.g., internal APIs, metadata services), potentially leading to further compromise depending on the deployment environment. This issue has been fixed in AVideo version 22.0.

[CVE-2026-3101] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was found in Intelbras TIP 635G 1.12.3.5. This vulnerability affects unknown code of the component Ping Handler. The manipulation results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.