Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nublado

20 ℃

84%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 12:00:01

[USD] USD 62,627.63

[BRL] BRL 324,721.14 [USD] USD 62,627.63 [GBP] GBP 46,891.00 [EUR] EUR 54,742.06
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 12:19:10 up 287 days, 20:50, 6 users, load average: 0.00, 0.02, 0.00

[03/07/2026 15:16] Durigan diz que PIX não prejudica americanos e defende 'racionalidade' em decisão dos EUA sobre tarifas - G1

[03/07/2026 17:52] Moraes mantém prisão domiciliar humanitária de Jair Bolsonaro - Correio Braziliense

[03/07/2026 22:02] Datafolha: direita supera esquerda pela primeira vez desde 2014, aponta pesquisa - O GLOBO

[04/07/2026 03:30] "Defeso eleitoral" passa a valer hoje para Lula e governadores; entenda - CNN Brasil

[04/07/2026 05:00] Dono de postos que abasteceram carros da campanha de Castro foi alvo da PF, que apura ligação com ex-governador e Bacellar - G1

[03/07/2026 19:58] Michelle Bolsonaro visita PL Mulher e posa para foto com antiga equipe após imagem de papelão viralizar - O GLOBO

[04/07/2026 08:29] Ônibus com romeiros tomba e deixa mortos e feridos no Ceará - G1

[03/07/2026 08:03] PF prende alvo de sanção dos EUA em operação contra PCC - Poder360

[03/07/2026 21:07] Suspeito de atirar em tenente da Rota pode estar em fuga com a família - CNN Brasil

[03/07/2026 14:17] Alerta de perigo: 449 cidades entram na rota de massa polar que trará frio congelante ao Sul do país - NSC Total

[CVE-2018-25178] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] Easyndexer 1.0 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the file parameter. Attackers can send POST requests to showtif.php with arbitrary file paths in the file parameter to retrieve system files like configuration and initialization files.

[CVE-2018-25186] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.3:MEDIUM] Tina4 Stack 1.0.3 contains a cross-site request forgery vulnerability that allows attackers to modify admin user credentials by submitting forged POST requests to the profile endpoint. Attackers can craft HTML forms targeting the /kim/profile endpoint with hidden fields containing malicious user data like passwords and email addresses to update administrator accounts without authentication.

[CVE-2018-25187] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.2:HIGH] Tina4 Stack 1.0.3 contains multiple vulnerabilities allowing unauthenticated attackers to access sensitive database files and execute SQL injection attacks. Attackers can directly request the kim.db database file to retrieve user credentials and password hashes, or inject SQL code through the menu endpoint to manipulate database queries.

[CVE-2018-25190] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.3:MEDIUM] Easyndexer 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative accounts by submitting forged POST requests. Attackers can craft malicious web pages that submit POST requests to createuser.php with parameters including username, password, name, surname, and privileges set to 1 for administrator access.

[CVE-2018-25199] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.2:HIGH] OOP CMS BLOG 1.0 contains SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through multiple parameters. Attackers can inject SQL commands via the search parameter in search.php, pageid parameter in page.php, and id parameter in posts.php to extract database information including table names, schema names, and database credentials.

[CVE-2018-25200] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.3:MEDIUM] OOP CMS BLOG 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by crafting malicious POST requests. Attackers can submit forms to the addUser.php endpoint with parameters including userName, password, email, and role set to administrative privileges to gain unauthorized access.

[CVE-2026-26051] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.4:CRITICAL] WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

[CVE-2026-2752] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.3:MEDIUM] Navtor NavBox allows information disclosure via the /api/ais-data endpoint. A remote, unauthenticated attacker can send crafted requests to trigger an unhandled exception, causing the server to return verbose .NET stack traces. These error messages expose internal class names, method calls, and third-party library references (e.g., System.Data.SQLite), which may assist attackers in mapping the application's internal structure.

[CVE-2026-2753] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] An Absolute Path Traversal vulnerability exists in Navtor NavBox. The application exposes an HTTP service that fails to properly sanitize user-supplied path input. Unauthenticated remote attackers can exploit this issue by submitting requests containing absolute filesystem paths. Successful exploitation allows the attacker to retrieve arbitrary files from the underlying filesystem, limited only by the privileges of the service process. This can lead to the exposure of sensitive configuration files and system information.

[CVE-2026-2754] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints. An unauthenticated remote attacker with network access to the device can execute HTTP GET requests to TCP port 8080 to retrieve internal network parameters including ECDIS & OT Information, device identifiers, and service status logs.

[CVE-2026-20748] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.3:HIGH] The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

[CVE-2026-20882] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.

[CVE-2026-24696] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.

[CVE-2026-26288] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.4:CRITICAL] WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

[CVE-2026-27764] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.3:HIGH] The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

[CVE-2025-15602] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance.

[CVE-2025-70363] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] Incorrect access control in the REST API of Ibexa & Ciril GROUP eZ Platform / Ciril Platform 2.x allows unauthenticated attackers to access sensitive data via enumerating object IDs.

[CVE-2026-29064] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.2:HIGH] Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction allows a specifically crafted Zarf package to create symlinks pointing outside the destination directory, enabling arbitrary file read or write on the system processing the package. This issue has been patched in version 0.73.1.

[CVE-2026-29075] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.3:HIGH] Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behaviors. In version 3.5.0 and prior, checking out of untrusted code in benchmarks.yml workflow may lead to code execution in privileged runner. This issue has been patched via commit c35b8cd.

[CVE-2026-29082] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.3:HIGH] Kestra is an event-driven orchestration platform. In versions from 1.1.10 and prior, Kestra’s execution-file preview renders user-supplied Markdown (.md) with markdown-it instantiated as html:true and injects the resulting HTML with Vue’s v-html without sanitisation. At time of publication, there are no publicly available patches.