Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu pouco nublado

24 ℃

65%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 14:00:02

[USD] USD 60,680.59

[BRL] BRL 314,695.63 [USD] USD 60,680.59 [GBP] GBP 45,966.64 [EUR] EUR 53,277.68
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 14:00:09 up 280 days, 22:31, 7 users, load average: 0.00, 0.00, 0.00

[27/06/2026 10:29] Buscas na Venezuela chegam ao terceiro dia e número de mortos passa de 900 - CNN Brasil

[27/06/2026 07:07] O vídeo de Michelle contra Flávio Bolsonaro se voltou contra ela? - BBC

[27/06/2026 12:21] Irmão de Eloá Pimentel, tenente da Rota é baleado na cabeça por dupla em moto em São Caetano do Sul - G1

[26/06/2026 17:41] Leia a íntegra da carta de Marco Rubio para Flávio Bolsonaro - Poder360

[26/06/2026 20:51] Guarda Revolucionária do Irã ataca posições dos EUA - Correio do Povo

[26/06/2026 13:23] Lula comissiona navio e provoca Trump: "Está cheio de nego maluco no mundo" - CNN Brasil

[27/06/2026 03:55] Caso Dark Horse: empresa ligada a filme tem sócio envolvido com o PCC - Correio Braziliense

[27/06/2026 00:14] Jerônimo chora ao defender Jaques Wagner: "Nós confiamos em você" - Poder360

[26/06/2026 08:56] Brasil x Japão: Servidores federais serão liberados às 11h na segunda (29) - Correio Braziliense

[27/06/2026 08:26] Governador de SC diz que Lula mente e o chama de "cara de pau" - Poder360

[CVE-2026-2751] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.3:HIGH] Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.This issue affects Centreon Web on Central Server before 25.10.8, 24.10.20, 24.04.24.

[CVE-2026-3223] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.8:HIGH] Arbitrary file write & potential privilege escalation exploiting zip slip vulnerability in Google Web Designer.

[CVE-2026-2359] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by dropping connection during file upload, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.

[CVE-2026-2749] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.9:CRITICAL] Vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centroen Open Ticket modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10.3, 24.10.8, 24.04.7.

[CVE-2026-2750] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.1:CRITICAL] Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10; 24.10;24.04.

[CVE-2026-3304] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.

[CVE-2025-69437] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.7:HIGH] PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsFileUtils.java. If a user uploads a PDF file containing a malicious payload to the system and views it, the embedded JavaScript payload can be triggered, resulting in issues such as credential theft, arbitrary API execution, and other security concerns. This vulnerability affects all file upload endpoint, including /cmsTemplate/save, /file/doUpload, /cmsTemplate/doUpload, /file/doBatchUpload, /cmsWebFile/doUpload, etc.

[CVE-2026-24488] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, an arbitrary file exfiltration vulnerability in the fax sending endpoint allows any authenticated user to read and transmit any file on the server (including database credentials, patient documents, system files, and source code) via fax to an attacker-controlled phone number. The vulnerability exists because the endpoint accepts arbitrary file paths from user input and streams them to the fax gateway without path restrictions or authorization checks. As of time of publication, no known patched versions are available.

[CVE-2026-25147] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.1:HIGH] OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, in `portal/portal_payment.php`, the patient id used for the page is taken from the request (`$pid = $_REQUEST['pid'] ?? $pid` and `$pid = ($_REQUEST['hidden_patient_code'] ?? null) > 0 ? $_REQUEST['hidden_patient_code'] : $pid`) instead of being fixed to the authenticated portal user. The portal session already has a valid `$pid` for the logged-in patient. Overwriting it with user-supplied values and using it without authorization allows a portal user to view and interact with another patient's demographics, invoices, and payment history—horizontal privilege escalation and IDOR. Version 8.0.0 contains a fix for the issue.

[CVE-2026-2293] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled. This issue affects nest.Js: 11.1.13.

[CVE-2019-25489] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.2:HIGH] Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the hosting_id parameter. Attackers can send GET requests to the rooms/ajax_refresh_subtotal endpoint with malicious hosting_id values to extract sensitive database information or cause denial of service.

[CVE-2019-25490] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.2:HIGH] Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'id' parameter. Attackers can send GET requests to the admin/edit.php endpoint with time-based SQL injection payloads to extract sensitive database information.

[CVE-2019-25491] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.2:HIGH] Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the catid parameter. Attackers can send GET requests to the admin/cms_getpagetitle.php endpoint with malicious catid values to extract sensitive database information.

[CVE-2019-25492] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.2:HIGH] Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pt' parameter. Attackers can send GET requests to the admin/getcmsdata.php endpoint with malicious 'pt' values to extract sensitive database information.

[CVE-2019-25493] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.2:HIGH] Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'val' parameter. Attackers can send GET requests to the admin/getrecord.php endpoint with malicious 'val' values to extract sensitive database information.

[CVE-2019-25494] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.2:HIGH] Homey BNB V4 contains an SQL injection vulnerability in the administration panel login that allows unauthenticated attackers to bypass authentication by injecting SQL syntax into username and password fields. Attackers can submit SQL operators like '=' 'or' in both credentials to manipulate the authentication query and gain unauthorized access to the admin panel.

[CVE-2019-25495] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.2:HIGH] osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the reviews_id parameter. Attackers can send GET requests to product_reviews_write.php with malicious reviews_id values using boolean-based SQL injection payloads to extract sensitive database information.

[CVE-2019-25496] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.2:HIGH] osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the products_id parameter. Attackers can modify the products_id value in product_info.php requests and append boolean-based SQL injection payloads to extract sensitive database information.

[CVE-2019-25497] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.2:HIGH] osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the currency parameter. Attackers can send GET requests to shopping_cart.php with malicious currency values using boolean-based SQL injection payloads to extract sensitive database information.

[CVE-2026-26861] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.3:HIGH] CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using the includes() method, which can be bypassed by an attacker using a subdomain