Weaknesses of type CWE-367

680 results

Condição de corrida entre verificação e uso (TOCTOU)

A aplicação verifica uma condição (ex: permissão, existência de arquivo) e depois usa o recurso baseado naquela verificação, mas entre os dois momentos outro processo pode mudar o estado do recurso. O atacante explora a janela de tempo para alterar o que foi verificado, contornando a validação.

Example

Um programa verifica se um arquivo existe e tem permissão de leitura, depois o abre para processar. Entre a verificação e a abertura, um atacante pode trocar o arquivo por um link simbólico apontando para um arquivo sensível do sistema. O programa abre o link sem perceber a mudança.

How to mitigate

Use operações atômicas que combinam verificação e uso em uma única chamada de sistema (ex: open() com flags exclusivas, fstat() após abrir arquivo). Em casos de acesso a dados compartilhados, implemente locks ou transações que impeçam alterações entre a validação e o uso do recurso.

CVE-2025-71215HIGHA time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent iCore service signature verification could allow a local aEPSS 0.3%CVE-2026-45208HIGHA time-of-check time-of-use vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installaEPSS 0.3%CVE-2021-31422HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.1-49141. An attacker muEPSS 0.3%CVE-2026-54754CRITICALKlever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)EPSS 0.3%CVE-2026-87433HIGHRace condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypaEPSS 0.3%CVE-2026-67607HIGHLightFTP 2.3.1 Race Condition DoS via worker_thread_cleanupEPSS 0.3%CVE-2026-25728CRITICALClipBucket v5 Affected by Remote Code Execution via Avatar/Background File Upload Race ConditionEPSS 0.3%CVE-2023-3891HIGHLapce v0.2.8 - Privilege escalation via Race ConditionEPSS 0.3%CVE-2023-2007—The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations EPSS 0.3%CVE-2022-36929HIGHLocal Privilege Escalation in Zoom Rooms for Windows ClientsEPSS 0.3%CVE-2026-20677CRITICALA race condition was addressed with improved handling of symbolic links. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iEPSS 0.3%CVE-2020-8016MEDIUMrace condition in the packaging of texlive-filesystenEPSS 0.3%CVE-2026-53801HIGHrsync < 3.5.0 Symlink Race Condition Directory TraversalEPSS 0.3%CVE-2026-50631HIGHApache CXF: OAuth2: TOCTOU Race Condition in Refresh Token ProcessingEPSS 0.3%CVE-2025-54895HIGHSPNEGO Extended Negotiation (NEGOEX) Security Mechanism Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2024-11222MEDIUMTime-of-check Time-of-use (TOCTOU) Race Condition in GitLabEPSS 0.3%CVE-2021-31427HIGHThis vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. An EPSS 0.3%CVE-2026-21240HIGHWindows HTTP.sys Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-53708MEDIUMContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)EPSS 0.3%CVE-2022-33270HIGHTime-of-check time-of-use race condition in ModemEPSS 0.3%