7 results (0.010 seconds)

CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0

CVE-2023-50428

https://notcve.org/view.php?id=CVE-2023-50428

In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FALSE OP_IF), as exploited in the wild by Inscriptions in 2022 and 2023. NOTE: although this is a vulnerability from the perspective of the Bitcoin Knots project, some others consider it "not a bug." En Bitcoin Core hasta 26.0 y Bitcoin Knots anteriores a 25.1.knots20231115, los límites de tamaño del portador de datos se pueden eludir ofuscando los datos como código (por ejemplo, con OP_FALSE OP_IF), tal como lo explotó Inscriptions en 2022 y 2023. • https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures https://github.com/bitcoin/bitcoin/blob/65c05db660b2ca1d0076b0d8573a6760b3228068/src/kernel/mempool_options.h#L46-L53 https://github.com/bitcoin/bitcoin/pull/28408#issuecomment-1844981799 https://github.com/bitcoin/bitcoin/tags https://github.com/bitcoinknots/bitcoin/blob/aed49ce8989334c364a219a6eb016a3897d4e3d7/doc/release-notes.md https://twitter.com/LukeDashjr/status/1732204937466032285 •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2023-33297

https://notcve.org/view.php?id=CVE-2023-33297

Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023. • https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures https://github.com/bitcoin/bitcoin/blob/master/doc/release-notes/release-notes-24.1.md https://github.com/bitcoin/bitcoin/issues/27586 https://github.com/bitcoin/bitcoin/issues/27623 https://github.com/bitcoin/bitcoin/pull/27610 https://github.com/dogecoin/dogecoin/issues/3243#issuecomment-1712575544 https://github.com/visualbasic6/drain https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2E • CWE-400: Uncontrolled Resource Consumption •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1

CVE-2021-3195

https://notcve.org/view.php?id=CVE-2021-3195

bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin directory) via a dumpwallet RPC call. NOTE: this reportedly does not violate the security model of Bitcoin Core, but can violate the security model of a fork that has implemented dumpwallet restrictions ** EN DISPUTA ** bitcoind en Bitcoin Core versiones hasta 0.21.0, puede crear un nuevo archivo en un directorio arbitrario (por ejemplo, fuera del directorio ~/.bitcoin) por medio de una llamada RPC dumpwallet NOTA: según se informa, esto no viola el modelo de seguridad de Bitcoin Core, pero puede violar el modelo de seguridad de un fork que haya implementado restricciones de dumpwallet • https://github.com/bitcoin/bitcoin/issues/20866 • CWE-20: Improper Input Validation •

CVSS: 7.5EPSS: 0%CPEs: 24EXPL: 1

CVE-2018-17145

https://notcve.org/view.php?id=CVE-2018-17145

Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka INVDoS. NOTE: this can also affect other cryptocurrencies, e.g., if they were forked from Bitcoin Core after 2017-11-15. Bitcoin Core versiones 0.16.x anteriores a 0.16.2 y Bitcoin Knots versiones 0.16.x anteriores a 0.16.2, permite la denegación de servicio remota por medio de una avalancha de mensajes inv de transacciones múltiples con hashes aleatorios, también se conoce como INVDoS. NOTA: esto también puede afectar a otras criptomonedas, por ejemplo, si se bifurcaron desde Bitcoin Core después del 15/11/2017 • https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17145 https://github.com/bitcoin/bitcoin/blob/v0.16.2/doc/release-notes.md https://invdos.net https://invdos.net/paper/CVE-2018-17145.pdf • CWE-400: Uncontrolled Resource Consumption •

CVSS: 5.3EPSS: 0%CPEs: 51EXPL: 1

CVE-2018-20586

https://notcve.org/view.php?id=CVE-2018-20586

bitcoind and Bitcoin-Qt prior to 0.17.1 allow injection of arbitrary data into the debug log via an RPC call. bitcoind y Bitcoin-Qt versiones anteriores a 0.17.1, permiten una inyección de datos arbitrarios en el registro de depuración por medio de una llamada RPC. • https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-20586 • CWE-116: Improper Encoding or Escaping of Output •