Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu pouco nublado

9 ℃

98%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 07:00:02

[USD] USD 81,237.15

[BRL] BRL 397,737.09 [USD] USD 81,237.15 [GBP] GBP 60,111.51 [EUR] EUR 69,405.69
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 07:22:29 up 235 days, 15:53, 3 users, load average: 0.00, 0.00, 0.00

[13/05/2026 01:05] Lula acaba com taxa das blusinhas de olho na eleição - Poder360

[13/05/2026 03:30] Defesa das urnas, climão com Alcolumbre, Michelle ao lado da mulher de Moraes: tudo sobre a posse de Nunes Marques no TSE - O Globo

[12/05/2026 13:15] União Europeia vai proibir a compra de carne e animais do Brasil a partir de setembro - Estadão

[12/05/2026 20:02] Senado aprova MP que cria renovação automática da CNH para motoristas sem infrações - Revista Oeste

[12/05/2026 15:03] Marqueteiro de Flávio foi citado em plano de Vorcaro contra BC e recebeu R$ 650 mil de dono de agência - Folha de S.Paulo

[12/05/2026 08:38] Sindicato realiza assembleia nesta terça (12) para decidir sobre greve no Metrô de SP - Brasil de Fato

[12/05/2026 18:51] Acidente no Anel Rodoviário causa congestionamento em BH; veja fotos - Estado de Minas

[13/05/2026 00:01] Lula destina equivalente a 0,73% do lucro anual das organizações criminosas para combatê-las - Diário do Poder

[12/05/2026 16:16] Em meio a greve da USP, deputado do MBL protocola PL que pode impedir estudantes de ingressar na universidade - CartaCapital

[12/05/2026 16:37] Frio diminui no Sul nesta quarta-feira, após recorde de menor temperatura no país este ano - Climatempo

[CVE-2025-40942] [Modified: 22-01-2026] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.4). Affected application contains a local privilege escalation vulnerability that could allow an attacker to run arbitrary code with elevated privileges.

[CVE-2025-59020] [Modified: 14-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

[CVE-2025-59021] [Modified: 14-01-2026] [Analyzed] [V3.1 S6.4:MEDIUM] Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any redirect record without restriction to the user’s own file-mounts or web-mounts. This allowed attackers to insert or alter redirects pointing to arbitrary URLs – facilitating phishing or other malicious redirect attacks. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

[CVE-2025-59022] [Modified: 14-01-2026] [Analyzed] [V3.1 S8.1:HIGH] Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

[CVE-2026-0859] [Modified: 14-01-2026] [Analyzed] [V3.1 S7.8:HIGH] TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

[CVE-2025-13774] [Modified: 05-02-2026] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.4 and 13.0.1 where an SQL injection vulnerability allows authenticated users to execute unintended SQL queries and commands.

[CVE-2025-11250] [Modified: 29-01-2026] [Analyzed] [V3.1 S9.1:CRITICAL] Zohocorp ManageEngine ADSelfService Plus versions before 6519 are vulnerable to Authentication Bypass due to improper filter configurations.

[CVE-2025-11669] [Modified: 02-02-2026] [Analyzed] [V3.1 S8.1:HIGH] Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an authorization issue in the initiate remote session functionality.

[CVE-2025-9435] [Modified: 29-01-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Zohocorp ManageEngine ADManager Plus versions below 7230 are vulnerable to Path Traversal in the User Management module

[CVE-2025-13444] [Modified: 13-02-2026] [Analyzed] [V3.1 S8.4:HIGH] OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters

[CVE-2025-13447] [Modified: 10-02-2026] [Analyzed] [V3.1 S8.4:HIGH] OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters

[CVE-2025-55462] [Modified: 05-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response along with Access-Control-Allow-Credentials: true. This permits malicious third-party websites to perform authenticated cross-origin requests against the Eramba API, including endpoints like /system-api/login and /system-api/user/me. The response includes sensitive user session data (ID, name, email, access groups), which is accessible to the attacker's JavaScript. This flaw enables full session hijack and data exfiltration without user interaction. Eramba versions 3.23.3 and earlier were tested and appear unaffected. The vulnerability is present in default installations, requiring no custom configuration.

[CVE-2024-54855] [Modified: 10-02-2026] [Analyzed] [V3.1 S6.4:MEDIUM] fabricators Ltd Vanilla OS 2 Core image v1.1.0 was discovered to contain static keys for the SSH service, allowing attackers to possibly execute a man-in-the-middle attack during connections with other hosts.

[CVE-2025-65783] [Modified: 05-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] An arbitrary file upload vulnerability in the /utils/uploadFile component of Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows attackers to execute arbitrary code via uploading a crafted PDF file.

[CVE-2025-66698] [Modified: 05-02-2026] [Analyzed] [V3.1 S8.6:HIGH] An issue in Semantic machines v5.4.8 allows attackers to bypass authentication via sending a crafted HTTP request to various API endpoints.

[CVE-2025-68817] [Modified: 26-02-2026] [Analyzed] [V3.1 S7.8:HIGH] In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency Under high concurrency, A tree-connection object (tcon) is freed on a disconnect path while another path still holds a reference and later executes *_put()/write on it.

[CVE-2025-68823] [Modified: 26-02-2026] [Analyzed] [V3.1 S5.5:MEDIUM] In the Linux kernel, the following vulnerability has been resolved: ublk: fix deadlock when reading partition table When one process(such as udev) opens ublk block device (e.g., to read the partition table via bdev_open()), a deadlock[1] can occur: 1. bdev_open() grabs disk->open_mutex 2. The process issues read I/O to ublk backend to read partition table 3. In __ublk_complete_rq(), blk_update_request() or blk_mq_end_request() runs bio->bi_end_io() callbacks 4. If this triggers fput() on file descriptor of ublk block device, the work may be deferred to current task's task work (see fput() implementation) 5. This eventually calls blkdev_release() from the same context 6. blkdev_release() tries to grab disk->open_mutex again 7. Deadlock: same task waiting for a mutex it already holds The fix is to run blk_update_request() and blk_mq_end_request() with bottom halves disabled. This forces blkdev_release() to run in kernel work-queue context instead of current task work context, and allows ublk server to make forward progress, and avoids the deadlock. [axboe: rewrite comment in ublk]

[CVE-2025-69990] [Modified: 16-01-2026] [Analyzed] [V3.1 S9.1:CRITICAL] phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in remove_file.php. The parameter file can cause any file to be deleted.

[CVE-2025-69991] [Modified: 16-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] phpgurukul News Portal Project V4.1 is vulnerable to SQL Injection in check_availablity.php.

[CVE-2025-69992] [Modified: 16-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] phpgurukul News Portal Project V4.1 has File Upload Vulnerability via upload.php, which enables the upload of files of any format to the server without identity authentication.