CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-50428
https://notcve.org/view.php?id=CVE-2023-50428
09 Dec 2023 — In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FALSE OP_IF), as exploited in the wild by Inscriptions in 2022 and 2023. NOTE: although this is a vulnerability from the perspective of the Bitcoin Knots project, some others consider it "not a bug." En Bitcoin Core hasta 26.0 y Bitcoin Knots anteriores a 25.1.knots20231115, los límites de tamaño del portador de datos se pueden eludir ofuscando los dato... • https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures •
CVSS: 7.8EPSS: 2%CPEs: 1EXPL: 0CVE-2023-33297 – Gentoo Linux Security Advisory 202408-12
https://notcve.org/view.php?id=CVE-2023-33297
22 May 2023 — Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023. A vulnerability has been discovered in Bitcoin, which can lead to a denial of service. Versions greater than or equal to 25.0 are affected. • https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-3195
https://notcve.org/view.php?id=CVE-2021-3195
21 Jan 2021 — bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin directory) via a dumpwallet RPC call. NOTE: this reportedly does not violate the security model of Bitcoin Core, but can violate the security model of a fork that has implemented dumpwallet restrictions ** EN DISPUTA ** bitcoind en Bitcoin Core versiones hasta 0.21.0, puede crear un nuevo archivo en un directorio arbitrario (por ejemplo, fuera del directorio ~/.bitcoin) por medio de una llam... • https://github.com/bitcoin/bitcoin/issues/20866 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 3%CPEs: 1EXPL: 0CVE-2017-12842
https://notcve.org/view.php?id=CVE-2017-12842
16 Mar 2020 — Bitcoin Core before 0.14 allows an attacker to create an ostensibly valid SPV proof for a payment to a victim who uses an SPV wallet, even if that payment did not actually occur. Completing the attack would cost more than a million dollars, and is relevant mainly only in situations where an autonomous system relies solely on an SPV proof for transactions of a greater dollar amount. Bitcoin Core versiones anteriores a 0.14, permite a un atacante crear una prueba SPV ostensiblemente válida para un pago a una ... • https://bitslog.wordpress.com/2018/06/09/leaf-node-weakness-in-bitcoin-merkle-tree-design • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-3641
https://notcve.org/view.php?id=CVE-2015-3641
12 Mar 2020 — bitcoind and Bitcoin-Qt prior to 0.10.2 allow attackers to cause a denial of service (disabled functionality such as a client application crash) via an "Easy" attack. bitcoind y Bitcoin-Qt versiones anteriores a 0.10.2, permiten a atacantes causar una denegación de servicio (funcionalidad desactivada tal y como un bloqueo de aplicación cliente) por medio de un ataque "Easy". • https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures •
CVSS: 5.3EPSS: 0%CPEs: 51EXPL: 1CVE-2018-20586
https://notcve.org/view.php?id=CVE-2018-20586
12 Mar 2020 — bitcoind and Bitcoin-Qt prior to 0.17.1 allow injection of arbitrary data into the debug log via an RPC call. bitcoind y Bitcoin-Qt versiones anteriores a 0.17.1, permiten una inyección de datos arbitrarios en el registro de depuración por medio de una llamada RPC. • https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-20586 • CWE-116: Improper Encoding or Escaping of Output •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2017-18350
https://notcve.org/view.php?id=CVE-2017-18350
12 Mar 2020 — bitcoind and Bitcoin-Qt prior to 0.15.1 have a stack-based buffer overflow if an attacker-controlled SOCKS proxy server is used. This results from an integer signedness error when the proxy server responds with an acknowledgement of an unexpected target domain name. bitcoind y Bitcoin-Qt versiones anteriores a 0.15.1, presentan un desbordamiento de búfer en la región stack de la memoria si es usado un servidor proxy SOCKS controlado por el atacante. Esto resulta de un error de la propiedad signedness de ent... • https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-20587
https://notcve.org/view.php?id=CVE-2018-20587
11 Feb 2019 — Bitcoin Core 0.12.0 through 0.17.1 and Bitcoin Knots 0.12.0 through 0.17.x before 0.17.1.knots20181229 have Incorrect Access Control. Local users can exploit this to steal currency by binding the RPC IPv4 localhost port, and forwarding requests to the IPv6 localhost port. Bitcoin Core, desde la versión 0.12.0 hasta la 0.17.1 y Bitcoin Knots, desde la versión 0.12.0 hasta la 0.17.x antes de la 0.17.1.knots20181229 tienen un control de acceso incorrecto. Los usuarios locales pueden explotar esta vulnerabilida... • https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-20587 •
CVSS: 7.5EPSS: 16%CPEs: 4EXPL: 2CVE-2018-17144
https://notcve.org/view.php?id=CVE-2018-17144
19 Sep 2018 — Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial of service (application crash) exploitable by miners via duplicate input. An attacker can make bitcoind or Bitcoin-Qt crash. Bitcoin Core en versiones 0.14.x anteriores a la 0.14.3, 0.15.x anteriores a la 0.15.2 y 0.16.x anteriores a la 0.16.3 y Bitcoin Knots desde las versiones 0.14.x hasta las 0.16.x anteriores a la 0.16.3 permiten una denegación rem... • https://github.com/iioch/ban-exploitable-bitcoin-nodes •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2016-10724
https://notcve.org/view.php?id=CVE-2016-10724
05 Jul 2018 — Bitcoin Core before v0.13.0 allows denial of service (memory exhaustion) triggered by the remote network alert system (deprecated since Q1 2016) if an attacker can sign a message with a certain private key that had been known by unintended actors, because of an infinitely sized map. This affects other uses of the codebase, such as Bitcoin Knots before v0.13.0.knots20160814 and many altcoins. Bitcoin Core en versiones anteriores a la v0.13.0 permite una denegación de servicio (DoS) desencadenada por el siste... • https://bitcoin.org/en/posts/alert-key-and-vulnerabilities-disclosure • CWE-400: Uncontrolled Resource Consumption •