Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nublado

15 ℃

95%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 23:00:02

[USD] USD 64,186.82

[BRL] BRL 330,664.84 [USD] USD 64,186.82 [GBP] GBP 48,501.43 [EUR] EUR 55,948.45
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 23:23:41 up 274 days, 7:55, 5 users, load average: 0.00, 0.00, 0.00

[20/06/2026 12:05] Datafolha 2º turno: Lula tem 47%, e Flávio Bolsonaro, 43% - G1

[20/06/2026 18:35] Irã alerta navios contra tentativas de atravessar o Estreito de Ormuz - CNN Brasil

[20/06/2026 13:22] O que há por trás de “misantropia” no alerta falso que usou o sistema da Defesa Civil - Gazeta do Povo

[20/06/2026 19:45] Onda de frio ganha força e pode levar neve ao Sul do Brasil nesta semana - CNN Brasil

[20/06/2026 17:13] Premiê da Itália diz que Trump deve cuidar de sua própria popularidade - CNN Brasil

[20/06/2026 13:03] Caso Dark Horse trava Flávio Bolsonaro e impede reação contra Lula no Datafolha - Brasil 247

[20/06/2026 18:28] Kim Kataguiri desiste de concorrer ao governo de SP para tentar novo mandato na Câmara - G1

[19/06/2026 19:31] Vorcaro marcou encontro com Jaques Wagner e disponibilizou avião para senador, indicam diálogos - Estadão

[20/06/2026 11:48] Cacique Raoni embarca em avião do Mato Grosso direto a hospital em São Paulo para continuidade do tratamento - AEROIN

[20/06/2026 14:30] Líder do Vox chama Moraes de 'delinquente' e diz que Eduardo sofreu 'golpe judicial' - Revista Oeste

[CVE-2025-15582] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.4:MEDIUM] A security flaw has been discovered in detronetdip E-commerce 1.0.0. The impacted element is the function Delete/Update of the component Product Management Module. Performing a manipulation of the argument ID results in authorization bypass. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2025-15583] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.5:LOW] A weakness has been identified in detronetdip E-commerce 1.0.0. This affects the function get_safe_value of the file utility/function.php. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2025-70833] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.4:CRITICAL] An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and fully takeover the account by manipulating POST parameters. The issue stems from insecure permission validation in check-power.php.

[CVE-2026-26093] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds 2.2.0.4 allows Command Injection via a crafted network request.

[CVE-2026-26095] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

[CVE-2026-26096] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

[CVE-2026-26097] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.

[CVE-2026-26098] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.

[CVE-2026-26099] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.

[CVE-2026-26100] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

[CVE-2026-26101] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.8:HIGH] Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

[CVE-2026-26102] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.8:HIGH] Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

[CVE-2026-26721] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.1:HIGH] An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to obtain sensitive information via the sid query parameter.

[CVE-2026-26722] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.4:CRITICAL] An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to escalate privileges via PIN component of the login functionality.

[CVE-2026-26723] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.2:HIGH] Cross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v. 20230721a allows a remote attacker to execute arbitrary code via the function parameter.

[CVE-2026-26745] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.3:MEDIUM] OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or parameter binding. This allows an attacker with access to modify the currency_symbol value to inject arbitrary SQL expressions, which are executed when the affected query is subsequently processed.

[CVE-2026-26746] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function. An attacker can read arbitrary files on the web server by manipulating the Invoice Type configuration. This issue can be chained with the file upload functionality to achieve Remote Code Execution (RCE).

[CVE-2026-26747] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.1:CRITICAL] A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.force_url" is not set and default is "false". The application generates absolute URLs (such as those used in password reset emails) using the user-supplied Host header. This allows remote attackers to poison the password reset link sent to a victim,

[CVE-2026-27502] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.1:MEDIUM] SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in log.php via the search query parameter. The application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a victim's browser if the victim visits a crafted URL. This can be used to steal session data, perform actions as the victim, or modify displayed content.

[CVE-2026-27503] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.1:MEDIUM] SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in admin/log.php via the search query parameter. When an authenticated administrator views a crafted URL, the application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing attacker-supplied JavaScript to execute in the administrator's browser. This can enable session theft, administrative action forgery, or other browser-based compromise in the context of an admin user.