Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nuvens quebradas

14 ℃

87%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 15:30:01

[USD] USD 77,723.37

[BRL] BRL 389,098.71 [USD] USD 77,723.37 [GBP] GBP 57,795.25 [EUR] EUR 66,847.07
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 15:55:15 up 244 days, 26 min, 3 users, load average: 0.20, 0.06, 0.02

[21/05/2026 14:03] Congresso derruba veto de Lula e permite doações a estados e municípios durante campanha eleitoral - G1

[21/05/2026 12:36] Investigação aponta Deolane como "verdadeiro caixa" do PCC; entenda - CNN Brasil

[21/05/2026 12:40] Cobrado por CPMI do Master, Alcolumbre descarta instalação e pede desculpa - CNN Brasil

[21/05/2026 11:35] Letícia Casado: Gestão de Rogério Marinho agrava crise na pré-campanha de Flávio Bolsonaro - UOL Notícias

[21/05/2026 09:53] A PF recusa a delação meia-boca de Vorcaro; a PGR não - Metrópoles

[21/05/2026 10:42] Flávio Bolsonaro articula encontro com Trump em meio à crise com Vorcaro - Correio Braziliense

[21/05/2026 10:29] Operação da Polícia Federal afasta prefeito e vice-prefeita de Jardim (CE) - Diário do Nordeste

[21/05/2026 13:16] DC decide expulsar Aldo Rebelo do partido; político diz que aposta em Joaquim Barbosa é 'afronta' - G1

[21/05/2026 14:11] Dayany do Capitão deve perder mandato de deputada após suplente ser cassado pelo TSE; entenda - O POVO

[21/05/2026 12:44] Gilmar Mendes diz apoiar decretos de Lula que fiscalizam big techs - Poder360

[CVE-2025-70645] [Modified: 26-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the deviceList parameter of the formSetWifiMacFilterCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

[CVE-2025-70650] [Modified: 26-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the deviceList parameter of the formSetMacFilterCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

[CVE-2025-70651] [Modified: 26-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow in the ssid parameter of the form_fast_setting_wifi_set function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

[CVE-2025-57681] [Modified: 02-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] The WorklogPRO - Timesheets for Jira plugin in Jira Data Center before version 4.23.6-jira10 and before version 4.23.5-jira9 allows users and attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability. The vulnerability is exploited via a specially crafted payload placed in an issue's summary field

[CVE-2025-70644] [Modified: 26-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the time parameter of the sub_60CFC function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

[CVE-2025-70646] [Modified: 26-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow in the security parameter of the sub_72290 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

[CVE-2025-70648] [Modified: 26-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow in the security_5g parameter of the sub_727F4 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

[CVE-2026-20045] [Modified: 13-02-2026] [Analyzed] [V3.1 S8.2:HIGH] A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.  This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.  Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.

[CVE-2021-47748] [Modified: 02-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation. Attackers can inject commands into the run_sql endpoint by crafting malicious GraphQL queries that execute system commands through PostgreSQL's COPY FROM PROGRAM functionality.

[CVE-2021-47778] [Modified: 06-03-2026] [Analyzed] [V3.1 S7.2:HIGH] GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through plugin configuration parameters, leading to remote code execution on the server.

[CVE-2021-47802] [Modified: 02-02-2026] [Analyzed] [V3.1 S7.5:HIGH] Tenda D151 and D301 routers contain an unauthenticated configuration download vulnerability that allows remote attackers to retrieve router configuration files. Attackers can send a request to /goform/getimage endpoint to download configuration data including admin credentials without authentication.

[CVE-2021-47817] [Modified: 02-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] OpenEMR 5.0.2.1 contains a cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript through user profile parameters. Attackers can exploit the vulnerability by crafting a malicious payload to download and execute a web shell, enabling remote command execution on the vulnerable OpenEMR instance.

[CVE-2021-47830] [Modified: 06-03-2026] [Analyzed] [V3.1 S6.5:MEDIUM] GetSimple CMS My SMTP Contact Plugin 1.1.1 contains a cross-site request forgery (CSRF) vulnerability. Attackers can craft a malicious webpage that, when visited by an authenticated administrator, can change SMTP configuration settings in the plugin. This may allow unauthorized changes but does not directly enable remote code execution.

[CVE-2021-47849] [Modified: 02-02-2026] [Analyzed] [V3.1 S6.2:MEDIUM] Mini Mouse 9.3.0 contains a path traversal vulnerability that allows attackers to access sensitive system directories through the device information endpoint. Attackers can retrieve file lists from system directories like /usr, /etc, and /var by manipulating file path parameters in API requests.

[CVE-2021-47850] [Modified: 02-02-2026] [Analyzed] [V3.1 S7.5:HIGH] Mini Mouse 9.2.0 contains a path traversal vulnerability that allows remote attackers to access arbitrary system files and directories through crafted HTTP requests. Attackers can retrieve sensitive files like win.ini and list contents of system directories such as C:\Users\Public by manipulating file and path parameters.

[CVE-2021-47851] [Modified: 02-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Mini Mouse 9.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands through an unauthenticated HTTP endpoint. Attackers can leverage the /op=command endpoint to download and execute payloads by sending crafted JSON requests with malicious script commands.

[CVE-2021-47857] [Modified: 05-03-2026] [Analyzed] [V3.1 S7.2:HIGH] Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows attackers to inject malicious scripts. Attackers can craft a calendar event with malicious JavaScript in the subtitle track label to execute arbitrary code when users view the event.

[CVE-2021-47860] [Modified: 06-03-2026] [Analyzed] [V3.1 S5.3:MEDIUM] GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator browsers. Attackers can craft a malicious website that triggers a cross-site scripting payload to execute remote code on the hosting server when an authenticated administrator visits the page.

[CVE-2025-66959] [Modified: 02-02-2026] [Analyzed] [V3.1 S7.5:HIGH] An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder

[CVE-2025-66960] [Modified: 02-02-2026] [Analyzed] [V3.1 S7.5:HIGH] An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function readGGUFV1String reads a string length from untrusted GGUF metadata