Fallos del tipo CWE-367

680 resultados

Condição de corrida entre verificação e uso (TOCTOU)

Ocorre quando o código verifica uma condição (ex: permissão de arquivo, saldo bancário) e depois usa o recurso, mas entre a verificação e o uso algo muda. Um atacante explora essa janela de tempo para alterar o estado, burlar a validação e executar operações não autorizadas.

Ejemplo

Um processo verifica se tem permissão de leitura em um arquivo, mas antes de ler, um outro processo muda o arquivo de lugar ou altera suas permissões. O primeiro processo tenta ler o que acredita ser o arquivo autorizado, mas na verdade acessa outro recurso.

Cómo mitigar

Use operações atômicas que combinam verificação e acesso em um único passo (ex: abrir arquivo com flags específicas). Em transações, implemente locks ou mecanismos de sincronização para evitar mudanças entre a validação e execução da ação.

CVE-2026-71272HIGHMemos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()EPSS 0.2%CVE-2022-33983HIGHDMA transactions which are targeted at input buffers used for the NvmExpressLegacy software SMI handler could cause SMRAM corruption throughEPSS 0.2%CVE-2024-13942HIGHRockchip RK3588s Secure BootROM TOCTOU (time-of-check to time-of-use) vulnerability leading to arbitrary code execution with highest privilegesEPSS 0.2%CVE-2024-10972HIGHWinPmem Improper Input Validation vulnerabilityEPSS 0.2%CVE-2026-7846LOWchatchat-space Langchain-Chatchat OpenAI-Compatible File Upload API openai_routes.py files toctouEPSS 0.2%CVE-2026-91708LOWRace condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtaEPSS 0.2%CVE-2024-13944HIGHLink Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate (Also affects Avast CleanUp and AVG TuneUp)EPSS 0.2%CVE-2022-4149HIGHLocal privilege escalation using log fileEPSS 0.2%CVE-2026-21725LOWAuthorization Bypass via TOCTOU in Grafana Datasource Deletion by NameEPSS 0.2%CVE-2022-34398HIGH Dell BIOS contains a Time-of-check Time-of-use vulnerability. A local authenticated malicious user could\u00a0potentially exploit this vulnEPSS 0.2%CVE-2026-41045HIGHWeak polkit authentication check in qSnapperEPSS 0.2%CVE-2026-49114MEDIUMONNX symlink-following and path-traversal arbitrary file writeEPSS 0.2%CVE-2025-46326LOWSnowflake Connector for .NET has race condition when checking access to Easy Logging configuration fileEPSS 0.2%CVE-2026-71210MEDIUMmealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata AccessEPSS 0.2%CVE-2022-33984HIGHDMA transactions which are targeted at input buffers used for the SdMmcDevice software SMI handler could cause SMRAM corruption through a TOEPSS 0.2%CVE-2022-33906MEDIUMDMA transactions which are targeted at input buffers used for the FwBlockServiceSmm software SMI handler could cause SMRAM corruption througEPSS 0.2%CVE-2022-33907MEDIUMDMA transactions which are targeted at input buffers used for the software SMI handler used by the IdeBusDxe driver could cause SMRAM corrupEPSS 0.2%CVE-2022-33982MEDIUMDMA attacks on the parameter buffer used by the Int15ServiceSmm software SMI handler could lead to a TOCTOU attack on the SMI handler and leEPSS 0.2%CVE-2022-30774MEDIUMDMA attacks on the parameter buffer used by the PnpSmm driver could change the contents after parameter values have been checked but before EPSS 0.2%CVE-2025-61037HIGHA local privilege escalation vulnerability exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). The flaw is a Time-of-Check Time-of-UseEPSS 0.2%