CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-50428
https://notcve.org/view.php?id=CVE-2023-50428
In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FALSE OP_IF), as exploited in the wild by Inscriptions in 2022 and 2023. NOTE: although this is a vulnerability from the perspective of the Bitcoin Knots project, some others consider it "not a bug." En Bitcoin Core hasta 26.0 y Bitcoin Knots anteriores a 25.1.knots20231115, los límites de tamaño del portador de datos se pueden eludir ofuscando los datos como código (por ejemplo, con OP_FALSE OP_IF), tal como lo explotó Inscriptions en 2022 y 2023. • https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures https://github.com/bitcoin/bitcoin/blob/65c05db660b2ca1d0076b0d8573a6760b3228068/src/kernel/mempool_options.h#L46-L53 https://github.com/bitcoin/bitcoin/pull/28408#issuecomment-1844981799 https://github.com/bitcoin/bitcoin/tags https://github.com/bitcoinknots/bitcoin/blob/aed49ce8989334c364a219a6eb016a3897d4e3d7/doc/release-notes.md https://twitter.com/LukeDashjr/status/1732204937466032285 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2CVE-2023-37192
https://notcve.org/view.php?id=CVE-2023-37192
Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing them to redirect Bitcoin transactions to wallets of their own choosing. Los problemas de gestión de memoria y protección en Bitcoin Core v22 permiten a los atacantes modificar la dirección de envío almacenada en la memoria de la aplicación, lo que potencialmente les permite redirigir las transacciones de Bitcoin a los monederos de su elección. • https://bitcoin.org/en/bitcoin-core https://satoshihunter1.blogspot.com/2023/06/the-bitcoin-app-is-vulnerable-to-hackers.html https://www.youtube.com/watch?v=oEl4M1oZim0 • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-33297
https://notcve.org/view.php?id=CVE-2023-33297
Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023. • https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures https://github.com/bitcoin/bitcoin/blob/master/doc/release-notes/release-notes-24.1.md https://github.com/bitcoin/bitcoin/issues/27586 https://github.com/bitcoin/bitcoin/issues/27623 https://github.com/bitcoin/bitcoin/pull/27610 https://github.com/dogecoin/dogecoin/issues/3243#issuecomment-1712575544 https://github.com/visualbasic6/drain https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2E • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3024 – Simple Bitcoin Faucets <= 1.7.0 - Unauthorised AJAX Call to Stored XSS
https://notcve.org/view.php?id=CVE-2022-3024
The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues El plugin Simple Bitcoin Faucets de WordPress versiones hasta 1.7.0, no presenta ningún tipo de autorización y de tipo CSRF en una acción AJAX, permitiendo a cualquier usuario autenticado, como los suscriptores, llamarlo y añadir/borrar/editar Bonos. Además, debido a una falta de saneo y escape, también podría conllevar a problemas de tipo Cross-Site Scripting Almacenado. The Bitcoin Satoshi Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via one of its AJAX calls in versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://wpscan.com/vulnerability/7f43cb8e-0c1b-4528-8c5c-b81ab42778dc • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-352: Cross-Site Request Forgery (CSRF) CWE-863: Incorrect Authorization •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3025 – Bitcoin / Altcoin Faucet <= 1.6.0 - Settings Update to Stored XSS via CSRF
https://notcve.org/view.php?id=CVE-2022-3025
The Bitcoin / Altcoin Faucet WordPress plugin through 1.6.0 does not have any CSRF check when saving its settings, allowing attacker to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues El plugin Bitcoin / Altcoin Faucet de WordPress versiones hasta 1.6.0, no presenta ninguna comprobación de tipo CSRF cuando guarda sus ajustes, lo que permite a un atacante hacer que un administrador conectado los cambie por medio de un ataque de tipo CSRF. Además, debido a una falta de saneo y escape, también podría conllevar a problemas de tipo Cross-Site Scripting Almacenado. The Bitcoin / Altcoin Faucet plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.0. This is due to missing or incorrect nonce validation when saving plugin settings. • https://wpscan.com/vulnerability/66bc783b-67e1-4bd0-99c0-322873b3a22a • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-352: Cross-Site Request Forgery (CSRF) •