Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu pouco nublado

27 ℃

53%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 17:00:02

[USD] USD 80,899.14

[BRL] BRL 397,554.57 [USD] USD 80,899.14 [GBP] GBP 59,336.37 [EUR] EUR 68,625.45
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 17:18:04 up 232 days, 1:49, 4 users, load average: 0.01, 0.00, 0.00

[09/05/2026 14:20] Moraes suspende primeiros pedidos de aplicação da Dosimetria - CNN Brasil

[09/05/2026 07:56] Hantavírus: A raiva e resignação com chegada de cruzeiro contaminado em ilha da Espanha - BBC

[09/05/2026 10:35] Thiago Ávila é solto por Israel após uma semana detido - Correio Braziliense

[09/05/2026 07:31] A dobradinha entre Flávio Bolsonaro e Ciro Nogueira dois dias antes da operação - Estado de Minas

[09/05/2026 13:26] Ciclone-bomba coloca 169 cidades em perigo de chuvas com ventos de 100 km/h neste sábado - NSC Total

[09/05/2026 10:56] Flávio Bolsonaro explica chapa em SC e vê Senado “mais propício” a impeachment no STF em 2027 - NSC Total

[09/05/2026 10:43] BH: pedestre é encontrado no Rio Arrudas em resgate de motociclista morto - Estado de Minas

[09/05/2026 10:13] Boeing 737 com pintura do Mercado Livre sai da pista ao pousar em Salvador - AEROIN

[08/05/2026 19:57] Trump reafirma bom relacionamento com Lula após encontro - CNN Brasil

[09/05/2026 04:30] Ministros indicados por Bolsonaro comandarão eleição no TSE pela 1ª vez - CNN Brasil

[CVE-2025-15035] [Modified: 09-03-2026] [Analyzed] [V3.1 S7.3:HIGH] Improper Input Validation vulnerability in TP-Link Archer AXE75 v1.6 (vpn modules) allows an authenticated adjacent attacker to delete arbitrary server file, leading to possible loss of critical system files and service interruption or degraded functionality.This issue affects Archer AXE75 v1.6: ≤ build 20250107.

[CVE-2025-15493] [Modified: 29-04-2026] [Analyzed] [V3.1 S6.3:MEDIUM] A flaw has been found in RainyGao DocSys up to 2.02.36. The impacted element is an unknown function of the file src/com/DocSystem/mapping/ReposAuthMapper.xml. Executing a manipulation of the argument searchWord can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-15494] [Modified: 29-04-2026] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability has been found in RainyGao DocSys up to 2.02.37. This affects an unknown function of the file com/DocSystem/mapping/UserMapper.xml. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-15495] [Modified: 29-04-2026] [Analyzed] [V3.1 S4.7:MEDIUM] A vulnerability was found in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/editsite.php. The manipulation of the argument image results in unrestricted upload. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-46645] [Modified: 05-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release version 8.3.1.10, LTS2024 release versions 7.13.1.0 through 7.13.1.40, LTS 2023 release versions 7.10.1.0 through 7.10.1.70, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

[CVE-2025-69542] [Modified: 10-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] A Command Injection Vulnerability has been discovered in the DHCP daemon service of D-Link DIR895LA1 v102b07. The vulnerability exists in the lease renewal processing logic where the DHCP hostname parameter is directly concatenated into a system command without proper sanitization. When a DHCP client renews an existing lease with a malicious hostname, arbitrary commands can be executed with root privileges.

[CVE-2025-70161] [Modified: 22-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] EDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection. This arises because the pppUserName field is directly passed to a shell command via the system() function without proper sanitization. An attacker can exploit this by injecting malicious commands into the pppUserName field, allowing arbitrary code execution.

[CVE-2026-22194] [Modified: 14-01-2026] [Analyzed] [V3.1 S8.8:HIGH] GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of client requests. An attacker can induce a logged-in user to submit crafted requests that perform actions with the victim's privileges. This can be exploited to create privileged accounts by targeting the administrative user creation endpoint.

[CVE-2026-22195] [Modified: 14-01-2026] [Analyzed] [V3.1 S8.1:HIGH] GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in the search bar functionality. User-controlled search input is incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries. Successful exploitation can result in unauthorized access to or modification of database contents depending on database privileges.

[CVE-2026-22196] [Modified: 14-01-2026] [Analyzed] [V3.1 S8.1:HIGH] GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in ticket creation functionality. User-controlled input provided during ticket creation is incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries. Successful exploitation can result in unauthorized access to or modification of database contents depending on database privileges.

[CVE-2026-22197] [Modified: 14-01-2026] [Analyzed] [V3.1 S8.1:HIGH] GestSup versions prior to 3.2.60 contain multiple SQL injection vulnerabilities in the asset list functionality. Multiple request parameters used to filter, search, or sort assets are incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries. Successful exploitation can result in unauthorized access to or modification of database contents depending on database privileges.

[CVE-2026-22198] [Modified: 14-01-2026] [Analyzed] [V3.1 S6.1:MEDIUM] GestSup versions prior to 3.2.60 contain a pre-authentication stored cross-site scripting (XSS) vulnerability in the API error logging functionality. By sending an API request with a crafted X-API-KEY header value (for example, to /api/v1/ticket.php), an unauthenticated attacker can cause attacker-controlled HTML/JavaScript to be written to log entries. When an administrator later views the affected logs in the web interface, the injected content is rendered without proper output encoding, resulting in arbitrary script execution in the administrator’s browser session.

[CVE-2025-66715] [Modified: 22-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] A DLL hijacking vulnerability in Axtion ODISSAAS ODIS v1.8.4 allows attackers to execute arbitrary code via a crafted DLL file.

[CVE-2025-67810] [Modified: 10-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] In Area9 Rhapsode 1.47.3, an authenticated attacker can exploit the operation, url, and filename parameters via POST request to read arbitrary files from the server filesystem. Fixed in 1.47.4 (#7254) and further versions.

[CVE-2025-67811] [Modified: 10-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Area9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated users. Insufficient input validation allows remote attackers to inject arbitrary SQL commands, resulting in unauthorized database access and potential compromise of sensitive data. Fixed in v.1.47.4 and beyond.

[CVE-2025-51626] [Modified: 22-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] SQL injection vulnerability in pss.sale.com 1.0 via the id parameter to the userfiles/php/cancel_order.php endpoint.

[CVE-2025-60538] [Modified: 22-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.

[CVE-2026-0830] [Modified: 28-04-2026] [Analyzed] [V3.1 S7.8:HIGH] Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before version 0.6.18 when opening maliciously crafted workspaces. To mitigate, users should update to the latest version.

[CVE-2025-15499] [Modified: 22-01-2026] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability has been found in Sangfor Operation and Maintenance Management System up to 3.0.8. This vulnerability affects the function uploadCN of the file VersionController.java. The manipulation of the argument filename leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-15500] [Modified: 22-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] A vulnerability was found in Sangfor Operation and Maintenance Management System up to 3.0.8. This issue affects some unknown processing of the file /isomp-protocol/protocol/getHis of the component HTTP POST Request Handler. The manipulation of the argument sessionPath results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.