Fallos del tipo CWE-367

799 resultados

Condição de corrida entre verificação e uso (TOCTOU)

Ocorre quando o código verifica uma condição (ex: permissão de arquivo, saldo bancário) e depois usa o recurso, mas entre a verificação e o uso algo muda. Um atacante explora essa janela de tempo para alterar o estado, burlar a validação e executar operações não autorizadas.

Ejemplo

Um processo verifica se tem permissão de leitura em um arquivo, mas antes de ler, um outro processo muda o arquivo de lugar ou altera suas permissões. O primeiro processo tenta ler o que acredita ser o arquivo autorizado, mas na verdade acessa outro recurso.

Cómo mitigar

Use operações atômicas que combinam verificação e acesso em um único passo (ex: abrir arquivo com flags específicas). Em transações, implemente locks ou mecanismos de sincronização para evitar mudanças entre a validação e execução da ação.

CVE-2026-75524MEDIUMOpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agentEPSS 0.3%CVE-2026-89430HIGHGitea push mirror SSRF and forced writes to internal Git hostsEPSS 0.3%CVE-2026-55537HIGHPraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114EPSS 0.3%CVE-2026-113038MEDIUMRace condition in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system EPSS 0.3%CVE-2026-19975LOWAzuriom CMS Money Transfer ProfileController.php transferMoney toctouEPSS 0.3%CVE-2026-23950HIGHnode-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFSEPSS 0.3%CVE-2026-57114HIGHPraisonAI: Jobs webhook SSRF protection bypass via DNS rebindingEPSS 0.3%CVE-2026-79046MEDIUMRace condition in Permissions in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering EPSS 0.3%CVE-2021-0289MEDIUMJunos OS: User-defined ARP Policer isn't applied on Aggregated Ethernet (AE) interface until firewall process is restartedEPSS 0.3%CVE-2024-6787MEDIUMMXview One Series vulnerable to Time-of-check Time-of-use (TOCTOU) Race ConditionEPSS 0.3%CVE-2026-113196MEDIUMRace condition in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTMLEPSS 0.3%CVE-2023-23389MEDIUMMicrosoft Defender Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2015-1865MEDIUMfts.c in coreutils 8.4 allows local users to delete arbitrary files.EPSS 0.3%CVE-2026-71272HIGHMemos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()EPSS 0.3%CVE-2026-13113MEDIUMTime-of-check Time-of-use (TOCTOU) Race Condition in GitLabEPSS 0.3%CVE-2020-8354MEDIUMA potential vulnerability in the SMI callback function used in the VariableServiceSmm driver in some Lenovo Notebook models may allow arbitrEPSS 0.3%CVE-2026-57959HIGHHi.Events 1.9.0 - Promo Code Max-Usage Bypass via Asynchronous Job Race ConditionEPSS 0.3%CVE-2024-9512MEDIUMTime-of-check Time-of-use (TOCTOU) Race Condition in GitLabEPSS 0.3%CVE-2024-9183HIGHTime-of-check Time-of-use (TOCTOU) Race Condition in GitLabEPSS 0.3%CVE-2026-121050HIGHRace condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a craftEPSS 0.3%