Weaknesses of type CWE-367

680 results

Condição de corrida entre verificação e uso (TOCTOU)

A aplicação verifica uma condição (ex: permissão, existência de arquivo) e depois usa o recurso baseado naquela verificação, mas entre os dois momentos outro processo pode mudar o estado do recurso. O atacante explora a janela de tempo para alterar o que foi verificado, contornando a validação.

Example

Um programa verifica se um arquivo existe e tem permissão de leitura, depois o abre para processar. Entre a verificação e a abertura, um atacante pode trocar o arquivo por um link simbólico apontando para um arquivo sensível do sistema. O programa abre o link sem perceber a mudança.

How to mitigate

Use operações atômicas que combinam verificação e uso em uma única chamada de sistema (ex: open() com flags exclusivas, fstat() após abrir arquivo). Em casos de acesso a dados compartilhados, implemente locks ou transações que impeçam alterações entre a validação e o uso do recurso.

CVE-2025-46328LOWNodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration fileEPSS 0.2%CVE-2022-33983HIGHDMA transactions which are targeted at input buffers used for the NvmExpressLegacy software SMI handler could cause SMRAM corruption throughEPSS 0.2%CVE-2024-10972HIGHWinPmem Improper Input Validation vulnerabilityEPSS 0.2%CVE-2024-13942HIGHRockchip RK3588s Secure BootROM TOCTOU (time-of-check to time-of-use) vulnerability leading to arbitrary code execution with highest privilegesEPSS 0.2%CVE-2026-7846LOWchatchat-space Langchain-Chatchat OpenAI-Compatible File Upload API openai_routes.py files toctouEPSS 0.2%CVE-2026-91708LOWRace condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtaEPSS 0.2%CVE-2024-13944HIGHLink Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate (Also affects Avast CleanUp and AVG TuneUp)EPSS 0.2%CVE-2026-21725LOWAuthorization Bypass via TOCTOU in Grafana Datasource Deletion by NameEPSS 0.2%CVE-2022-4149HIGHLocal privilege escalation using log fileEPSS 0.2%CVE-2022-34398HIGH Dell BIOS contains a Time-of-check Time-of-use vulnerability. A local authenticated malicious user could\u00a0potentially exploit this vulnEPSS 0.2%CVE-2026-41045HIGHWeak polkit authentication check in qSnapperEPSS 0.2%CVE-2026-49114MEDIUMONNX symlink-following and path-traversal arbitrary file writeEPSS 0.2%CVE-2025-46326LOWSnowflake Connector for .NET has race condition when checking access to Easy Logging configuration fileEPSS 0.2%CVE-2022-33984HIGHDMA transactions which are targeted at input buffers used for the SdMmcDevice software SMI handler could cause SMRAM corruption through a TOEPSS 0.2%CVE-2026-71210MEDIUMmealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata AccessEPSS 0.2%CVE-2022-33982MEDIUMDMA attacks on the parameter buffer used by the Int15ServiceSmm software SMI handler could lead to a TOCTOU attack on the SMI handler and leEPSS 0.2%CVE-2022-33906MEDIUMDMA transactions which are targeted at input buffers used for the FwBlockServiceSmm software SMI handler could cause SMRAM corruption througEPSS 0.2%CVE-2022-33907MEDIUMDMA transactions which are targeted at input buffers used for the software SMI handler used by the IdeBusDxe driver could cause SMRAM corrupEPSS 0.2%CVE-2025-61037HIGHA local privilege escalation vulnerability exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). The flaw is a Time-of-Check Time-of-UseEPSS 0.2%CVE-2022-30774MEDIUMDMA attacks on the parameter buffer used by the PnpSmm driver could change the contents after parameter values have been checked but before EPSS 0.2%