Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nuvens dispersas

18 ℃

78%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 12:00:02

[USD] USD 73,030.74

[BRL] BRL 370,298.11 [USD] USD 73,030.74 [GBP] GBP 54,224.45 [EUR] EUR 62,599.03
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 12:20:23 up 251 days, 20:51, 4 users, load average: 0.06, 0.01, 0.00

[29/05/2026 05:14] EUA declaram PCC e CV organizações terrorisas: como o governo Lula perdeu a batalha - BBC

[28/05/2026 21:34] Caso Henry: cabeleireira relata ligação de vídeo em que menino disse à mãe que ‘tio’ tinha dado uma ‘banda’ - O GLOBO

[29/05/2026 07:31] PoderData/Aya: Lula e Flávio empatam no 2º turno - Poder360

[29/05/2026 07:49] Esposa de Rabicó, chefe do CV, é presa em operação contra facção no RJ - CNN Brasil

[29/05/2026 07:30] Auditor do BC trocou mensagens com Vorcaro sobre compra de ativos pelo Rioprevidência - ICL Notícias

[29/05/2026 08:15] Vídeo: foguete da Blue Origin explode na plataforma de lançamento durante teste - Correio do Povo

[29/05/2026 03:00] Fim da escala 6x1: oposição avança com proposta alternativa no Senado - CNN Brasil

[29/05/2026 06:00] Mais de 700 pessoas vão parar nas ruas de BH a cada mês; mulheres são as mais vulneráveis - O TEMPO

[28/05/2026 07:24] Eduardo Bolsonaro ataca a Fórum por reportagem sobre foto de Flávio Bolsonaro com Trump - Revista Fórum

[29/05/2026 03:30] Aliados de João Campos veem campanha negativa nas redes como motivo de virada de Raquel Lyra em pesquisa - O GLOBO

[CVE-2025-7015] [Modified: 09-03-2026] [Analyzed] [V3.1 S5.7:MEDIUM] Session Fixation vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Session Fixation.This issue affects QR Menu: before s1.05.12.

[CVE-2025-7016] [Modified: 09-03-2026] [Analyzed] [V3.1 S8.0:HIGH] Improper Access Control vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Authentication Abuse.This issue affects QR Menu: before s1.05.12.

[CVE-2026-1469] [Modified: 09-03-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Stored Cross-Site Scripting (XSS) in RLE NOVA's PlanManager. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting malicious payload through the ‘comment’ and ‘brand’ parameters in ‘/index.php’. The payload is stored by the application and subsequently displayed without proper sanitization when other users access it. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.

[CVE-2025-7013] [Modified: 09-03-2026] [Analyzed] [V3.1 S5.7:MEDIUM] Authorization Bypass Through User-Controlled Key vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Exploitation of Trusted Identifiers.This issue affects Menu Panel: through 29012026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-7014] [Modified: 09-03-2026] [Analyzed] [V3.1 S5.7:MEDIUM] Session Fixation vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Session Hijacking.This issue affects Menu Panel: through 29012026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2026-1588] [Modified: 29-04-2026] [Analyzed] [V3.1 S2.7:LOW] A vulnerability was found in jishenghua jshERP up to 3.6. The impacted element is the function install of the file /jshERP-boot/plugin/installByPath of the component com.gitee.starblues.integration.operator.DefaultPluginOperator. The manipulation of the argument path results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2026-1616] [Modified: 10-03-2026] [Analyzed] [V3.1 S7.5:HIGH] The $uri$args concatenation in nginx configuration file present in Open Security Issue Management (OSIM) prior v2025.9.0 allows path traversal attacks via query parameters.

[CVE-2025-71008] [Modified: 03-02-2026] [Analyzed] [V3.1 S6.2:MEDIUM] A segmentation violation in the oneflow._oneflow_internal.autograd.Function.FunctionCtx.mark_non_differentiable component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

[CVE-2025-71009] [Modified: 03-02-2026] [Analyzed] [V3.1 S6.2:MEDIUM] An input validation vulnerability in the flow.scatter/flow.scatter_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted indices.

[CVE-2025-7713] [Modified: 10-03-2026] [Analyzed] [V3.1 S7.5:HIGH] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Global Interactive Design Media Software Inc. Content Management System (CMS) allows XSS Through HTTP Headers.This issue affects Content Management System (CMS): through 21072025.

[CVE-2025-7714] [Modified: 10-03-2026] [Analyzed] [V3.1 S7.5:HIGH] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Global Interactive Design Media Software Inc. Content Management System (CMS) allows Command Line Execution through SQL Injection.This issue affects Content Management System (CMS): through 21072025.

[CVE-2026-1589] [Modified: 29-04-2026] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was determined in itsourcecode School Management System 1.0. This affects an unknown function of the file /ramonsys/inquiry/index.php. This manipulation of the argument txtsearch causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

[CVE-2026-1590] [Modified: 29-04-2026] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was identified in itsourcecode School Management System 1.0. This impacts an unknown function of the file /ramonsys/faculty/index.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

[CVE-2026-1593] [Modified: 29-04-2026] [Analyzed] [V3.1 S7.3:HIGH] A weakness has been identified in itsourcecode Society Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/edit_expenses_query.php. Executing a manipulation of the argument detail can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

[CVE-2026-1594] [Modified: 29-04-2026] [Analyzed] [V3.1 S7.3:HIGH] A security vulnerability has been detected in itsourcecode Society Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/add_expenses.php. The manipulation of the argument detail leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

[CVE-2025-62514] [Modified: 02-03-2026] [Analyzed] [V3.1 S8.3:HIGH] Parsec is a cloud-based application for cryptographically secure file sharing. In versions on the 3.x branch prior to 3.6.0, `libparsec_crypto`, a component of the Parsec application, does not check for weak order point of Curve25519 when compiled with its RustCrypto backend. In practice this means an attacker in a man-in-the-middle position would be able to provide weak order points to both parties in the Diffie-Hellman exchange, resulting in a high probability to for both parties to obtain the same shared key (hence leading to a successful SAS code exchange, misleading both parties into thinking no MITM has occurred) which is also known by the attacker. Note only Parsec web is impacted (as Parsec desktop uses `libparsec_crypto` with the libsodium backend). Version 3.6.0 of Parsec patches the issue.

[CVE-2025-71011] [Modified: 03-02-2026] [Analyzed] [V3.1 S6.2:MEDIUM] An input validation vulnerability in the flow.Tensor.new_empty/flow.Tensor.new_ones/flow.Tensor.new_zeros component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

[CVE-2026-1595] [Modified: 29-04-2026] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was detected in itsourcecode Society Management System 1.0. This affects an unknown part of the file /admin/edit_student_query.php. The manipulation of the argument student_id results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

[CVE-2026-1596] [Modified: 29-04-2026] [Analyzed] [V3.1 S6.3:MEDIUM] A flaw has been found in D-Link DWR-M961 1.1.47. This vulnerability affects the function sub_419920 of the file /boafrm/formLtefotaUpgradeQuectel. This manipulation of the argument fota_url causes command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

[CVE-2026-1597] [Modified: 29-04-2026] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability has been found in Bdtask SalesERP up to 20260116. This issue affects some unknown processing of the component Administrative Endpoint. Such manipulation of the argument ci_session leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.