Threat database

Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages, because these are queued without the sending peer recorded as their source. A remote inbound peer can push many unique transactions to occupy a disproportionate share of mempool admission slots, crowding out honest peers' transaction relay.

A reachable assertion vulnerability exists in the getblock RPC method of the Zcash Foundation's Zebra node before version 11.0.0. When called with verbosity level 2 for a side-chain block, the method panics due to an unexpected conversion of a -1 confirmations sentinel value to an unsigned 32-bit integer, causing the node process to abort. This can be triggered remotely by unauthenticated attackers, including via the lightwalletd interface, potentially causing the node to enter a crash loop.

Zebra versions before 6.1.0 have a vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization. This occurs through poisoning the parent_error_map by delivering a coinbase-malleated block that shares a canonical block's hash prematurely, causing rejection of the next canonical block and stalling the node for about 2,000 blocks.

Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining_transaction_value that clones the entire block-level spent-UTXO map per transaction during contextual verification. Attackers can mine or seed the mempool with roughly 26,000 minimal single-input transactions in one block, stalling every validating node for over 52 seconds.

ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to degrade block processing by pushing transactions with invalid Orchard proofs without being misbehavior-scored. Attackers can repeatedly push invalid proofs into the shared halo2 batch verifier, forcing honest block proofs onto the slow individual-verification path and slowing block processing roughly sevenfold.

Zebra versions before 6.1.0 have a vulnerability in the ZIP-317 block template selector where the calculation of the block size budget incorrectly omits the header and transaction-count size. This allows attackers to insert valid transactions into a miner's mempool to create oversized block templates, which are then rejected, causing wasted proof-of-work.

Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verification by pushing V6 mempool transactions with invalid Halo2 proofs. Attackers can flood the shared unprioritized Halo2 verification queue with zero-fee transactions carrying zero-filled Orchard and Ironwood proofs, causing nodes to fall behind the chain tip.

The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a malicious peer can repeatedly serve a canonical block whose coinbase claims height 1 while keeping the requested hash, delaying the node's discovery of the newest block.

Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by leaving rejected hashes in SentHashes. Attackers can send a contextually invalid block sharing an honest block's header hash, causing Request::KnownBlock to skip the honest block and keep nodes behind the tip.

Zebra versions before 6.3.0 have a vulnerability in their misbehavior scoring mechanism. This flaw allows unauthenticated peers to bypass penalties by sending invalid gossiped blocks. The issue arises because the system incorrectly downcasts RouterError to VerifyBlockError during inbound cleanup, causing the misbehavior score to be discarded. As a result, attackers can repeatedly trigger block downloads and Equihash verification without being banned.

Zebra (zebrad) versions 4.5.0 up to but not including 6.3.0 have a vulnerability where the software discards information about which peer supplied block hashes in FindBlocks responses. This leads to banning peers that serve blocks significantly ahead of the current tip, potentially causing honest peers to be banned and increasing the risk of eclipse attacks.

Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translation file loading. Attackers with administrator access can upload a crafted theme containing malicious translation files to execute arbitrary code on the Ghost server.

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposing server configuration secrets.

Ghost versions from 4.39.0 up to but not including 6.64.0 have an information disclosure vulnerability in the Admin API. This flaw allows staff users with invite viewing permissions to see secret tokens of pending staff invites. Exploiting this, such users can accept pending invites for roles with higher privileges, leading to privilege escalation.

Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not directly reveal hashes or enable practical password recovery.

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost editor, published site, and newsletter emails, compromising staff admin sessions.

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or thumbnails to compromise other staff users' admin sessions.

Ghost versions from 0.5.0 up to but not including 6.64.0 contain an improper privilege management vulnerability. This flaw allows authenticated users with Editor or Super Editor roles to escalate privileges by assigning their own role to other staff members, despite lacking explicit permission. Specifically, Editors or Super Editors can promote Authors and Contributors to Editor or Super Editor roles.

Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to compromise other staff users' admin sessions.

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain protected rows' primary-key text and cell values.