Fallos del tipo CWE-367

680 resultados

Condição de corrida entre verificação e uso (TOCTOU)

Ocorre quando o código verifica uma condição (ex: permissão de arquivo, saldo bancário) e depois usa o recurso, mas entre a verificação e o uso algo muda. Um atacante explora essa janela de tempo para alterar o estado, burlar a validação e executar operações não autorizadas.

Ejemplo

Um processo verifica se tem permissão de leitura em um arquivo, mas antes de ler, um outro processo muda o arquivo de lugar ou altera suas permissões. O primeiro processo tenta ler o que acredita ser o arquivo autorizado, mas na verdade acessa outro recurso.

Cómo mitigar

Use operações atômicas que combinam verificação e acesso em um único passo (ex: abrir arquivo com flags específicas). Em transações, implemente locks ou mecanismos de sincronização para evitar mudanças entre a validação e execução da ação.

CVE-2026-44112HIGHOpenClaw < 2026.4.22 - Symlink Swap Race Condition in OpenShell FS Bridge WritesEPSS 2.7%CVE-2020-8867MEDIUMThis vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET StandEPSS 2.6%CVE-2026-20816HIGHWindows Installer Elevation of Privilege VulnerabilityEPSS 2.5%CVE-2024-24993HIGHA Race Condition (TOCTOU) vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute EPSS 2.4%CVE-2024-24995HIGHA Race Condition (TOCTOU) vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute EPSS 2.4%CVE-2020-24428HIGHAcrobat Reader DC for macOS Race Condition Vulnerability Could Lead to Privilege EscalationEPSS 2.3%CVE-2021-3969HIGHA Time of Check Time of Use (TOCTOU) vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation,EPSS 1.9%CVE-2021-3922HIGHA race condition vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1.EPSS 1.9%CVE-2024-39894HIGHOpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObsEPSS 1.6%CVE-2024-7348HIGHPostgreSQL relation replacement during pg_dump executes arbitrary SQLEPSS 1.6%CVE-2025-22224CRITICALVMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious acEPSS 1.6%KEVCVE-2019-5421—Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable`EPSS 1.6%CVE-2011-4126—Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to mount any device to aEPSS 1.5%CVE-2019-11775—All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loEPSS 1.5%CVE-2020-25860—The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signatuEPSS 1.4%CVE-2026-5947HIGHSIG(0) validation during query flood may lead to undefined behaviorEPSS 1.4%CVE-2022-21658HIGHRace condition in std::fs::remove_dir_all in rustlangEPSS 1.4%CVE-2024-29066HIGHWindows Distributed File System (DFS) Remote Code Execution VulnerabilityEPSS 1.3%CVE-2025-38352HIGHposix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()EPSS 1.3%KEVCVE-2025-29969HIGHMS-EVEN RPC Remote Code Execution VulnerabilityEPSS 1.2%