Fallos del tipo CWE-367

680 resultados

Condição de corrida entre verificação e uso (TOCTOU)

Ocorre quando o código verifica uma condição (ex: permissão de arquivo, saldo bancário) e depois usa o recurso, mas entre a verificação e o uso algo muda. Um atacante explora essa janela de tempo para alterar o estado, burlar a validação e executar operações não autorizadas.

Ejemplo

Um processo verifica se tem permissão de leitura em um arquivo, mas antes de ler, um outro processo muda o arquivo de lugar ou altera suas permissões. O primeiro processo tenta ler o que acredita ser o arquivo autorizado, mas na verdade acessa outro recurso.

Cómo mitigar

Use operações atômicas que combinam verificação e acesso em um único passo (ex: abrir arquivo com flags específicas). Em transações, implemente locks ou mecanismos de sincronização para evitar mudanças entre a validação e execução da ação.

CVE-2025-71215HIGHA time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent iCore service signature verification could allow a local aEPSS 0.3%CVE-2026-45208HIGHA time-of-check time-of-use vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installaEPSS 0.3%CVE-2021-31422HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.1-49141. An attacker muEPSS 0.3%CVE-2026-54754CRITICALKlever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)EPSS 0.3%CVE-2026-87433HIGHRace condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypaEPSS 0.3%CVE-2026-67607HIGHLightFTP 2.3.1 Race Condition DoS via worker_thread_cleanupEPSS 0.3%CVE-2026-25728CRITICALClipBucket v5 Affected by Remote Code Execution via Avatar/Background File Upload Race ConditionEPSS 0.3%CVE-2023-3891HIGHLapce v0.2.8 - Privilege escalation via Race ConditionEPSS 0.3%CVE-2023-2007—The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations EPSS 0.3%CVE-2022-36929HIGHLocal Privilege Escalation in Zoom Rooms for Windows ClientsEPSS 0.3%CVE-2026-20677CRITICALA race condition was addressed with improved handling of symbolic links. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iEPSS 0.3%CVE-2020-8016MEDIUMrace condition in the packaging of texlive-filesystenEPSS 0.3%CVE-2026-53801HIGHrsync < 3.5.0 Symlink Race Condition Directory TraversalEPSS 0.3%CVE-2026-50631HIGHApache CXF: OAuth2: TOCTOU Race Condition in Refresh Token ProcessingEPSS 0.3%CVE-2025-54895HIGHSPNEGO Extended Negotiation (NEGOEX) Security Mechanism Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2024-11222MEDIUMTime-of-check Time-of-use (TOCTOU) Race Condition in GitLabEPSS 0.3%CVE-2021-31427HIGHThis vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. An EPSS 0.3%CVE-2026-53708MEDIUMContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)EPSS 0.3%CVE-2026-21240HIGHWindows HTTP.sys Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2022-33270HIGHTime-of-check time-of-use race condition in ModemEPSS 0.3%