CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-50428
https://notcve.org/view.php?id=CVE-2023-50428
In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FALSE OP_IF), as exploited in the wild by Inscriptions in 2022 and 2023. NOTE: although this is a vulnerability from the perspective of the Bitcoin Knots project, some others consider it "not a bug." En Bitcoin Core hasta 26.0 y Bitcoin Knots anteriores a 25.1.knots20231115, los límites de tamaño del portador de datos se pueden eludir ofuscando los datos como código (por ejemplo, con OP_FALSE OP_IF), tal como lo explotó Inscriptions en 2022 y 2023. • https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures https://github.com/bitcoin/bitcoin/blob/65c05db660b2ca1d0076b0d8573a6760b3228068/src/kernel/mempool_options.h#L46-L53 https://github.com/bitcoin/bitcoin/pull/28408#issuecomment-1844981799 https://github.com/bitcoin/bitcoin/tags https://github.com/bitcoinknots/bitcoin/blob/aed49ce8989334c364a219a6eb016a3897d4e3d7/doc/release-notes.md https://twitter.com/LukeDashjr/status/1732204937466032285 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-33297
https://notcve.org/view.php?id=CVE-2023-33297
Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023. • https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures https://github.com/bitcoin/bitcoin/blob/master/doc/release-notes/release-notes-24.1.md https://github.com/bitcoin/bitcoin/issues/27586 https://github.com/bitcoin/bitcoin/issues/27623 https://github.com/bitcoin/bitcoin/pull/27610 https://github.com/dogecoin/dogecoin/issues/3243#issuecomment-1712575544 https://github.com/visualbasic6/drain https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2E • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-3195
https://notcve.org/view.php?id=CVE-2021-3195
bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin directory) via a dumpwallet RPC call. NOTE: this reportedly does not violate the security model of Bitcoin Core, but can violate the security model of a fork that has implemented dumpwallet restrictions ** EN DISPUTA ** bitcoind en Bitcoin Core versiones hasta 0.21.0, puede crear un nuevo archivo en un directorio arbitrario (por ejemplo, fuera del directorio ~/.bitcoin) por medio de una llamada RPC dumpwallet NOTA: según se informa, esto no viola el modelo de seguridad de Bitcoin Core, pero puede violar el modelo de seguridad de un fork que haya implementado restricciones de dumpwallet • https://github.com/bitcoin/bitcoin/issues/20866 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 51EXPL: 1CVE-2018-20586
https://notcve.org/view.php?id=CVE-2018-20586
bitcoind and Bitcoin-Qt prior to 0.17.1 allow injection of arbitrary data into the debug log via an RPC call. bitcoind y Bitcoin-Qt versiones anteriores a 0.17.1, permiten una inyección de datos arbitrarios en el registro de depuración por medio de una llamada RPC. • https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-20586 • CWE-116: Improper Encoding or Escaping of Output •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-20587
https://notcve.org/view.php?id=CVE-2018-20587
Bitcoin Core 0.12.0 through 0.17.1 and Bitcoin Knots 0.12.0 through 0.17.x before 0.17.1.knots20181229 have Incorrect Access Control. Local users can exploit this to steal currency by binding the RPC IPv4 localhost port, and forwarding requests to the IPv6 localhost port. Bitcoin Core, desde la versión 0.12.0 hasta la 0.17.1 y Bitcoin Knots, desde la versión 0.12.0 hasta la 0.17.x antes de la 0.17.1.knots20181229 tienen un control de acceso incorrecto. Los usuarios locales pueden explotar esta vulnerabilidad para robar dinero enlazando el puerto localhost IPv4 RPC y reenviando peticiones al puerto localhost IPv6. • https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-20587 https://medium.com/%40lukedashjr/cve-2018-20587-advisory-and-full-disclosure-a3105551e78b •