Weaknesses of type CWE-367

680 results

Condição de corrida entre verificação e uso (TOCTOU)

A aplicação verifica uma condição (ex: permissão, existência de arquivo) e depois usa o recurso baseado naquela verificação, mas entre os dois momentos outro processo pode mudar o estado do recurso. O atacante explora a janela de tempo para alterar o que foi verificado, contornando a validação.

Example

Um programa verifica se um arquivo existe e tem permissão de leitura, depois o abre para processar. Entre a verificação e a abertura, um atacante pode trocar o arquivo por um link simbólico apontando para um arquivo sensível do sistema. O programa abre o link sem perceber a mudança.

How to mitigate

Use operações atômicas que combinam verificação e uso em uma única chamada de sistema (ex: open() com flags exclusivas, fstat() após abrir arquivo). Em casos de acesso a dados compartilhados, implemente locks ou transações que impeçam alterações entre a validação e o uso do recurso.

CVE-2026-82238LOWfilebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploadsEPSS 0.2%CVE-2026-22281LOWDell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starEPSS 0.2%CVE-2026-73410HIGHBudibase: SSRF via DNS rebinding in the REST datasource integrationEPSS 0.2%CVE-2026-48344HIGHGoCart | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)EPSS 0.2%CVE-2026-88924HIGHGvfs: gvfs-admin socket ownership race permits local rootEPSS 0.2%CVE-2026-19975LOWAzuriom CMS Money Transfer ProfileController.php transferMoney toctouEPSS 0.2%CVE-2023-4155MEDIUMSev-es / sev-snp vmgexit double fetch vulnerabilityEPSS 0.2%CVE-2024-3292HIGHRace ConditionEPSS 0.2%CVE-2026-30332HIGHA Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalaEPSS 0.2%CVE-2025-46805MEDIUMScreen has a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-rootEPSS 0.2%CVE-2026-70667MEDIUMLemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)EPSS 0.2%CVE-2026-5303MEDIUMThe ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. ThEPSS 0.2%CVE-2022-31641HIGHPotential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escEPSS 0.2%CVE-2024-13960HIGHLink Following Local Privilege Escalation Vulnerability in AVG TuneUp Version 23.4EPSS 0.2%CVE-2024-13961HIGHAvast Cleanup Premium TuneupSvc Link Following Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2022-31640HIGHPotential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escEPSS 0.2%CVE-2023-1585MEDIUMAvast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the Quarantine process, leadiEPSS 0.2%CVE-2023-6803MEDIUMRace Condition allows Unauthorized Outside CollaboratorEPSS 0.2%CVE-2025-46328LOWNodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration fileEPSS 0.2%CVE-2022-44651HIGHA Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalaEPSS 0.2%