Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nublado

21 ℃

66%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 13:30:01

[USD] USD 65,681.42

[BRL] BRL 333,175.56 [USD] USD 65,681.42 [GBP] GBP 48,939.03 [EUR] EUR 56,627.83
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 13:40:09 up 256 days, 22:11, 5 users, load average: 0.00, 0.00, 0.00

[03/06/2026 08:45] Brasil, China e Reino Unido: Veja 60 economias que podem ter taxa dos EUA - CNN Brasil

[03/06/2026 11:00] Lula ataca Rubio por tarifaço, diz que vai mandar carta para Trump e ameaça procurar outros parceiros: ‘Eu nem ia ao G7, mas agora vou’ - O Globo

[03/06/2026 05:03] Entenda como deve ser o último dia do julgamento do caso Henry, com os réus Jairinho e Monique Medeiros - O Globo

[02/06/2026 20:01] Senado aprova projeto que dificulta o aborto legal em crianças - CartaCapital

[03/06/2026 05:08] Farra de Vorcaro para autoridades brasileiras com russas e ucranianas em Nova York custou quase R$ 12 milhões - Brasil 247

[03/06/2026 11:03] Greve geral em Portugal paralisa trens, voos e fecha escolas - CNN Brasil

[03/06/2026 10:48] Bicheiro Adilsinho e ex-PM Sem Alma têm prisão decretada por execução de policial penal ligado à máfia do cigarro - Extra online

[02/06/2026 16:17] FAB contradiz influenciador e diz não ter detectado suposto Ovni visto no Paraná - UOL

[03/06/2026 06:45] 53% defendem classificar PCC e CV como “terroristas” - Poder360

[02/06/2026 20:18] Sob protestos, Flávio Bolsonaro recebe título de cidadão honorário de Belo Horizonte - CartaCapital

[CVE-2019-25261] [Modified: 25-02-2026] [Analyzed] [V3.1 S7.8:HIGH] AnyDesk 5.4.0 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially inject malicious executables. Attackers can exploit the unquoted binary path to place malicious files in service executable locations, potentially gaining elevated system privileges.

[CVE-2020-37100] [Modified: 20-02-2026] [Analyzed] [V3.1 S7.8:HIGH] Sync Breeze Enterprise 12.4.18 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path by placing malicious executables in specific file system locations to hijack the service startup process.

[CVE-2025-13473] [Modified: 04-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

[CVE-2025-14550] [Modified: 04-02-2026] [Analyzed] [V3.1 S7.5:HIGH] An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Jiyong Yang for reporting this issue.

[CVE-2025-65017] [Modified: 23-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Decidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0.31.0, the private data exports can lead to data leaks in case the UUID generation, causing collisions for the generated UUIDs. This issue has been patched in versions 0.30.4 and 0.31.0.

[CVE-2026-1207] [Modified: 04-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

[CVE-2026-1285] [Modified: 04-02-2026] [Analyzed] [V3.1 S7.5:HIGH] An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

[CVE-2026-1287] [Modified: 04-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue.

[CVE-2026-1312] [Modified: 04-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in `FilteredRelation`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue.

[CVE-2026-21862] [Modified: 23-02-2026] [Analyzed] [V3.1 S7.5:HIGH] RustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: get_condition_values trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy IP-allowlist policies. This issue has been patched in version alpha.78.

[CVE-2026-23794] [Modified: 06-02-2026] [Analyzed] [V3.1 S6.8:MEDIUM] Reflected XSS in Apache Syncope's Enduser Login page. An attacker that tricks a legitimate user into clicking a malicious link and logging in to Syncope Enduser could steal that user's credentials. This issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3. Users are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.

[CVE-2026-23795] [Modified: 06-02-2026] [Analyzed] [V3.1 S4.9:MEDIUM] Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit Keymaster parameters via Console can construct malicious XML text to launch an XXE attack, thereby causing sensitive data leakage occurs. This issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3. Users are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.

[CVE-2026-24762] [Modified: 23-02-2026] [Analyzed] [V3.1 S7.5:HIGH] RustFS is a distributed object storage system built in Rust. From versions alpha.13 to alpha.81, RustFS logs sensitive credential material (access key, secret key, session token) to application logs at INFO level. This results in credentials being recorded in plaintext in log output, which may be accessible to internal or external log consumers and could lead to compromise of sensitive credentials. This issue has been patched in version alpha.82.

[CVE-2020-37103] [Modified: 09-02-2026] [Analyzed] [V3.1 S6.4:MEDIUM] DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through journal tools. Attackers can upload XML files with XHTML namespace scripts to execute arbitrary JavaScript in users' browsers, potentially bypassing CSRF protections and performing more damaging attacks.

[CVE-2020-37110] [Modified: 18-02-2026] [Analyzed] [V3.1 S8.2:HIGH] 60CycleCMS 2.5.2 contains an SQL injection vulnerability in news.php and common/lib.php that allows attackers to manipulate database queries through unvalidated user input. Attackers can exploit vulnerable query parameters like 'title' to inject malicious SQL code and potentially extract or modify database contents. This issue does not involve cross-site scripting.

[CVE-2020-37111] [Modified: 18-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] 60CycleCMS 2.5.2 contains a cross-site scripting (XSS) vulnerability in news.php that allows attackers to inject malicious scripts through GET parameters. Attackers can craft malicious URLs with XSS payloads targeting the 'etsu' and 'ltsu' parameters to execute arbitrary scripts in victim's browsers. This issue does not involve SQL injection.

[CVE-2020-37112] [Modified: 12-02-2026] [Analyzed] [V3.1 S7.1:HIGH] GUnet OpenEclass 1.7.3 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through unvalidated parameters. Attackers can exploit the 'month' parameter in the agenda module and other endpoints to extract sensitive database information using error-based or time-based injection techniques.

[CVE-2020-37113] [Modified: 12-02-2026] [Analyzed] [V3.1 S8.8:HIGH] GUnet OpenEclass 1.7.3 allows authenticated users to bypass file extension restrictions when uploading files. By renaming a PHP file to .php3 or .PhP, an attacker can upload a web shell and execute arbitrary code on the server. This vulnerability enables remote code execution by bypassing the intended file type checks in the exercise submission feature.

[CVE-2020-37114] [Modified: 10-02-2026] [Analyzed] [V3.1 S4.3:MEDIUM] GUnet OpenEclass 1.7.3 allows unauthenticated and authenticated users to access sensitive information, including system information, application version, and other students' uploaded assessments, due to improper access controls and information disclosure flaws in various modules. Attackers can retrieve system info, version info, and view or download other users' files without proper authorization.

[CVE-2020-37115] [Modified: 10-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] GUnet OpenEclass 1.7.3 stores user credentials in plaintext, allowing administrators to view all registered users' usernames and passwords without encryption. This vulnerability exposes sensitive information and increases the risk of credential theft and unauthorized access.