Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nublado

16 ℃

75%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 09:30:01

[USD] USD 62,504.07

[BRL] BRL 322,514.78 [USD] USD 62,504.07 [GBP] GBP 47,244.83 [EUR] EUR 54,512.12
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 09:30:53 up 272 days, 18:02, 5 users, load average: 0.00, 0.00, 0.00

[19/06/2026 03:30] PF expõe nova rede de operadores em caso que liga Jaques Wagner a ex-sócio de Vorcaro - O Globo

[18/06/2026 19:24] Val Ceasa movimentou pelo menos R$ 13 milhões com patrimônio declarado de R$ 1 milhão, aponta MPRJ - G1

[18/06/2026 18:07] Irã publica memorando assinado por Trump para encerrar guerra - Poder360

[19/06/2026 08:46] Frio histórico: cidade registra a menor temperatura do ano no Brasil - Rádio Itatiaia

[18/06/2026 15:30] Carros, R$ 27 mi e joias: os pertences de Deolane confiscados pela polícia - CNN Brasil

[18/06/2026 20:10] Departamento de Estado dos EUA chama condenação de Eduardo Bolsonaro no STF de 'perseguição e manipulação jurídica' - G1

[19/06/2026 04:00] Sem palanque definido em Minas, Lula vai a Belo Horizonte e Divinópolis, reduto de senador próximo a Flávio Bolsonaro - G1

[19/06/2026 02:00] Negociação não avança e derrubada de tarifaço dos EUA fica mais difícil - R7

[19/06/2026 08:39] Inverno sob El Niño terá alto risco de enchentes no Sul do Brasil - MetSul Meteorologia

[19/06/2026 07:07] Operação faz buscas contra BRB, Secretaria de Economia do DF e PicPay - G1

[CVE-2026-22269] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.7:MEDIUM] Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of Source of a Communication Channel vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.

[CVE-2026-26358] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

[CVE-2026-26359] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to the ability to overwrite arbitrary files.

[CVE-2026-26360] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.1:HIGH] Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability to delete arbitrary files.

[CVE-2026-26361] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

[CVE-2026-26362] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.1:HIGH] Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized modification of critical system files.

[CVE-2026-2735] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Stored Cross-Site Scripting (XSS) in Alkacon's OpenCms v18.0, which occurs when user input is not properly validated when sending a POST request to ‘/blog/new-article/org.opencms.ugc.CmsUgcEditService.gwt’ using the ‘text’ parameter.

[CVE-2026-2736] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Reflected Cross-site Scripting (XSS) in Alkacon's OpenCms v18.0, which allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL containing the ‘q’ parameter in ‘/search/index.html’. This vulnerability can be exploited to steal sensitive user information such as session cookies, or to perform actions while impersonating the user.

[CVE-2026-22266] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.7:MEDIUM] Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of Source of a Communication Channel vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.

[CVE-2026-22267] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.1:HIGH] Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

[CVE-2026-22268] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.3:MEDIUM] Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service of a Dell Enterprise Support connection.

[CVE-2025-15559] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an attacker to execute arbitrary commands on the WorkTime server as NT Authority\SYSTEM with the highest privileges. Attackers are able to access or manipulate sensitive data and take over the whole server.

[CVE-2025-15560] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL backend is used the attacker can execute arbitrary SQL statements on the database backend and gain access to sensitive data.

[CVE-2025-15561] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.8:HIGH] An attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system to NT Authority\SYSTEM. A malicious executable must be named WTWatch.exe and dropped in the C:\ProgramData\wta\ClientExe directory, which is writable by "Everyone". The executable will then be run by the WorkTime monitoring daemon.

[CVE-2025-15562] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.1:MEDIUM] The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim's browser if the victim opens a URL prepared by the attacker.

[CVE-2025-15563] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.3:MEDIUM] Any unauthenticated user can reset the WorkTime on-prem database configuration by sending a specific HTTP request to the WorkTime server. No authorization check is applied here.

[CVE-2019-25402] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted input to the username parameter. Attackers can send POST requests to the login endpoint with script payloads in the username field to execute arbitrary JavaScript in users' browsers.

[CVE-2019-25403] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.4:MEDIUM] Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the comment parameter. Attackers can inject JavaScript code through the admin_profiles endpoint that executes in the browsers of other users who view the affected page.

[CVE-2019-25404] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.4:MEDIUM] Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input through admin management parameters. Attackers can inject script payloads in the admin_name, name, and surname parameters via POST requests to the /korugan/admins endpoint, which are stored and executed when administrators access the interface.

[CVE-2019-25405] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.2:HIGH] Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the newLicense parameter. Attackers can send POST requests to the license activation endpoint with script payloads in the newLicense field to execute arbitrary JavaScript in administrators' browsers.