CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-52922
https://notcve.org/view.php?id=CVE-2024-52922
18 Nov 2024 — In Bitcoin Core before 25.1, an attacker can cause a node to not download the latest block, because there can be minutes of delay when an announcing peer stalls instead of complying with the peer-to-peer protocol specification. • https://bitcoincore.org/en/2024/11/05/cb-stall-hindering-propagation •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-51826 – WordPress Bitcoin Payments plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-51826
08 Nov 2024 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in James Turner Bitcoin Payments allows DOM-Based XSS.This issue affects Bitcoin Payments: from n/a through 1.4.2. The Bitcoin Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrar... • https://patchstack.com/database/vulnerability/bitcoin-payments/wordpress-bitcoin-payments-plugin-1-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-35202
https://notcve.org/view.php?id=CVE-2024-35202
10 Oct 2024 — Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling assertion and node exit) by including transactions in a blocktxn message that are not committed to in a block's merkle root. FillBlock can be called twice for one PartiallyDownloadedBlock instance. • https://bitcoincore.org/en/2024/10/08/disclose-blocktxn-crash • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-44073
https://notcve.org/view.php?id=CVE-2024-44073
19 Aug 2024 — The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth. • https://github.com/rust-bitcoin/rust-miniscript/compare/11.2.0...12.2.0 • CWE-674: Uncontrolled Recursion •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-50428
https://notcve.org/view.php?id=CVE-2023-50428
09 Dec 2023 — In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FALSE OP_IF), as exploited in the wild by Inscriptions in 2022 and 2023. NOTE: although this is a vulnerability from the perspective of the Bitcoin Knots project, some others consider it "not a bug." En Bitcoin Core hasta 26.0 y Bitcoin Knots anteriores a 25.1.knots20231115, los límites de tamaño del portador de datos se pueden eludir ofuscando los dato... • https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 2CVE-2023-37192
https://notcve.org/view.php?id=CVE-2023-37192
06 Jul 2023 — Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing them to redirect Bitcoin transactions to wallets of their own choosing. Los problemas de gestión de memoria y protección en Bitcoin Core v22 permiten a los atacantes modificar la dirección de envío almacenada en la memoria de la aplicación, lo que potencialmente les permite redirigir las transacciones de Bitcoin a los monederos de su elección. • https://bitcoin.org/en/bitcoin-core • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 7.8EPSS: 2%CPEs: 1EXPL: 0CVE-2023-33297 – Gentoo Linux Security Advisory 202408-12
https://notcve.org/view.php?id=CVE-2023-33297
22 May 2023 — Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023. A vulnerability has been discovered in Bitcoin, which can lead to a denial of service. Versions greater than or equal to 25.0 are affected. • https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3024 – Simple Bitcoin Faucets <= 1.7.0 - Unauthorised AJAX Call to Stored XSS
https://notcve.org/view.php?id=CVE-2022-3024
31 Aug 2022 — The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues El plugin Simple Bitcoin Faucets de WordPress versiones hasta 1.7.0, no presenta ningún tipo de autorización y de tipo CSRF en una acción AJAX, permitiendo a cualquier usuario autenticad... • https://wpscan.com/vulnerability/7f43cb8e-0c1b-4528-8c5c-b81ab42778dc • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-352: Cross-Site Request Forgery (CSRF) CWE-863: Incorrect Authorization •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3025 – Bitcoin / Altcoin Faucet <= 1.6.0 - Settings Update to Stored XSS via CSRF
https://notcve.org/view.php?id=CVE-2022-3025
31 Aug 2022 — The Bitcoin / Altcoin Faucet WordPress plugin through 1.6.0 does not have any CSRF check when saving its settings, allowing attacker to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues El plugin Bitcoin / Altcoin Faucet de WordPress versiones hasta 1.6.0, no presenta ninguna comprobación de tipo CSRF cuando guarda sus ajustes, lo que permite a un atacante hacer que un administrador conect... • https://wpscan.com/vulnerability/66bc783b-67e1-4bd0-99c0-322873b3a22a • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-31876
https://notcve.org/view.php?id=CVE-2021-31876
13 May 2021 — Bitcoin Core 0.12.0 through 0.21.1 does not properly implement the replacement policy specified in BIP125, which makes it easier for attackers to trigger a loss of funds, or a denial of service attack against downstream projects such as Lightning network nodes. An unconfirmed child transaction with nSequence = 0xff_ff_ff_ff, spending an unconfirmed parent with nSequence <= 0xff_ff_ff_fd, should be replaceable because there is inherited signaling by the child transaction. However, the actual PreChecks implem... • https://bitcoinops.org/en/newsletters/2021/05/12 • CWE-863: Incorrect Authorization •