Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu pouco nublado

19 ℃

64%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 14:00:02

[USD] USD 61,370.57

[BRL] BRL 316,470.91 [USD] USD 61,370.57 [GBP] GBP 45,962.81 [EUR] EUR 53,230.56
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 14:07:01 up 258 days, 22:38, 4 users, load average: 0.00, 0.00, 0.00

[05/06/2026 04:47] PCC e CV designados terroristas: os efeitos no México, Colômbia e Venezuela após governo Trump fazer isso com facções locais - BBC

[04/06/2026 19:45] Gleisi critica Eduardo Bolsonaro após fala sobre Pix e Zelle - Poder360

[05/06/2026 03:37] "Crime doloso contra vida pode ter perdão judicial?", contesta pai de Henry - CNN Brasil

[05/06/2026 09:06] Exército de Israel ordena retirada de moradores do Líbano em meio a ataques - CNN Brasil

[05/06/2026 11:26] Lula tem 47,8% e Flávio, 41,3%, no 2º turno, diz pesquisa - Poder360

[04/06/2026 21:45] Lula diz que vai a Washington negociar, mas precisa das tarifas para sua propaganda - Gazeta do Povo

[05/06/2026 09:44] Justiça manda prender jornalista perseguido por Carla Zambelli - Estadão

[04/06/2026 14:59] Sob pressão e às vésperas da eleição, senadores recuam em apoio a PEC da oposição sobre a 6×1 - CartaCapital

[05/06/2026 02:15] Inscrições para o Enem terminam nesta sexta-feira (5); saiba como fazer - CNN Brasil

[05/06/2026 07:05] Onde pode chover muito no Sul do Brasil no começo do El Niño - MetSul Meteorologia

[CVE-2025-13379] [Modified: 12-02-2026] [Analyzed] [V3.1 S8.6:HIGH] IBM Aspera Console 3.4.0 through 3.4.8 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

[CVE-2020-37151] [Modified: 20-02-2026] [Analyzed] [V3.1 S8.2:HIGH] phpMyChat Plus 1.98 contains a SQL injection vulnerability in the deluser.php page through the pmc_username parameter that allows attackers to manipulate database queries. Attackers can exploit boolean-based, error-based, and time-based blind SQL injection techniques to extract sensitive database information by crafting malicious payloads in the username field.

[CVE-2025-68722] [Modified: 24-02-2026] [Analyzed] [V3.1 S8.8:HIGH] Axigen Mail Server before 10.5.57 and 10.6.x before 10.6.26 contains a Cross-Site Request Forgery (CSRF) vulnerability in the WebAdmin interface through improper handling of the _s (breadcrumb) parameter. The application accepts state-changing requests via the GET method and automatically processes base64-encoded commands queued in the _s parameter immediately after administrator authentication. Attackers can craft malicious URLs that, when clicked by administrators, execute arbitrary administrative actions upon login without further user interaction, including creating rogue administrator accounts or modifying critical server configurations.

[CVE-2020-37117] [Modified: 24-02-2026] [Analyzed] [V3.1 S8.8:HIGH] jizhiCMS 1.6.7 contains a file download vulnerability in the admin plugins update endpoint that allows authenticated administrators to download arbitrary files. Attackers can exploit the vulnerability by sending crafted POST requests with malicious filepath and download_url parameters to trigger unauthorized file downloads.

[CVE-2020-37119] [Modified: 09-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Nsauditor 3.0.28 and 3.2.1.0 contains a buffer overflow vulnerability in the DNS Lookup tool that allows attackers to execute arbitrary code by overwriting memory. Attackers can craft a malicious DNS query payload to trigger a three-byte overwrite, bypass ASLR, and execute shellcode through a carefully constructed exploit.

[CVE-2020-37125] [Modified: 18-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Edimax EW-7438RPn-v3 Mini 1.27 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands through the /goform/mp endpoint. Attackers can exploit the vulnerability by sending crafted POST requests with command injection payloads to download and execute malicious scripts on the device.

[CVE-2020-37130] [Modified: 01-05-2026] [Analyzed] [V3.1 S7.5:HIGH] Nsauditor 3.2.0.0 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can create a malicious payload of 1000 bytes of repeated characters to trigger an application crash when pasted into the registration name field.

[CVE-2020-37131] [Modified: 26-03-2026] [Analyzed] [V3.1 S6.2:MEDIUM] Nsauditor Product Key Explorer 4.2.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by inputting a specially crafted registration key. Attackers can generate a payload of 1000 bytes of repeated characters and paste it into the 'Key' input field to trigger the application crash.

[CVE-2020-37132] [Modified: 09-02-2026] [Analyzed] [V3.1 S6.2:MEDIUM] UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in its password configuration properties that allows local attackers to crash the application. Attackers can paste an overly long 300-character string into the password field to trigger an application crash and prevent normal launcher functionality.

[CVE-2020-37133] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.5:HIGH] UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in the Repeater Host configuration field that allows attackers to crash the application. Attackers can paste an overly long string of 300 characters into the Repeater Host property to trigger an application crash.

[CVE-2020-37137] [Modified: 09-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] PHP-Fusion 9.03.50 contains a remote code execution vulnerability in the 'add_panel_form()' function that allows attackers to execute arbitrary code through an eval() function with unsanitized POST data. Attackers can exploit the vulnerability by sending crafted panel_content POST parameters to the panels.php administration endpoint to execute malicious code.

[CVE-2020-37140] [Modified: 27-03-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Everest, later referred to as AIDA64, 5.50.2100 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating file open functionality. Attackers can generate a 450-byte buffer of repeated characters and paste it into the file open dialog to trigger an application crash.

[CVE-2020-37149] [Modified: 18-02-2026] [Analyzed] [V3.1 S8.1:HIGH] Edimax EW-7438RPn-v3 Mini 1.27 is vulnerable to cross-site request forgery (CSRF) that can lead to command execution. An attacker can trick an authenticated user into submitting a crafted form to the /goform/mp endpoint, resulting in arbitrary command execution on the device with the user's privileges.

[CVE-2020-37150] [Modified: 18-02-2026] [Analyzed] [V3.1 S7.5:HIGH] Edimax EW-7438RPn-v3 Mini 1.27 allows unauthenticated attackers to access the /wizard_reboot.asp page in unsetup mode, which discloses the Wi-Fi SSID and security key. Attackers can retrieve the wireless password by sending a GET request to this endpoint, exposing sensitive information without authentication.

[CVE-2020-37152] [Modified: 09-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] PHP-Fusion 9.03.50 panels.php is vulnerable to cross-site scripting (XSS) via the 'panel_content' POST parameter. The application fails to properly sanitize user input before rendering it in the browser, allowing attackers to inject arbitrary JavaScript. This can be exploited by submitting crafted input to the 'panel_content' field in panels.php, resulting in execution of malicious scripts in the context of the affected site.

[CVE-2025-69906] [Modified: 11-02-2026] [Analyzed] [V3.1 S8.8:HIGH] Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies on blacklist-based file extension validation and stores uploaded files directly in a web-accessible directory. Under typical server configurations, this can allow an attacker to upload files that are interpreted as executable code, resulting in remote code execution.

[CVE-2025-70791] [Modified: 10-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19. An attacker can manipulate the "orderDirection" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the developers and fixed in version 2.0.20.

[CVE-2025-70792] [Modified: 10-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19. An attacker can manipulate the "rel_id" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the developers and fixed in version 2.0.20.

[CVE-2026-0714] [Modified: 18-02-2026] [Analyzed] [V3.1 S6.8:MEDIUM] A physical attack vulnerability exists in certain Moxa industrial computers using TPM-backed LUKS full-disk encryption on Moxa Industrial Linux 3, where the discrete TPM is connected to the CPU via an SPI bus. Exploitation requires invasive physical access, including opening the device and attaching external equipment to the SPI bus to capture TPM communications. If successful, the captured data may allow offline decryption of eMMC contents. This attack cannot be performed through brief or opportunistic physical access and requires extended physical access, possession of the device, appropriate equipment, and sufficient time for signal capture and analysis. Remote exploitation is not possible.

[CVE-2026-0715] [Modified: 18-02-2026] [Analyzed] [V3.1 S6.8:MEDIUM] Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device. An attacker with physical access to the device could use this information to access the bootloader menu via a serial interface. Access to the bootloader menu does not allow full system takeover or privilege escalation. The bootloader enforces digital signature verification and only permits flashing of Moxa-signed images. As a result, an attacker cannot install malicious firmware or execute arbitrary code. The primary impact is limited to a potential temporary denial-of-service condition if a valid image is reflashed. Remote exploitation is not possible.