Fallos del tipo CWE-367

799 resultados

Condição de corrida entre verificação e uso (TOCTOU)

Ocorre quando o código verifica uma condição (ex: permissão de arquivo, saldo bancário) e depois usa o recurso, mas entre a verificação e o uso algo muda. Um atacante explora essa janela de tempo para alterar o estado, burlar a validação e executar operações não autorizadas.

Ejemplo

Um processo verifica se tem permissão de leitura em um arquivo, mas antes de ler, um outro processo muda o arquivo de lugar ou altera suas permissões. O primeiro processo tenta ler o que acredita ser o arquivo autorizado, mas na verdade acessa outro recurso.

Cómo mitigar

Use operações atômicas que combinam verificação e acesso em um único passo (ex: abrir arquivo com flags específicas). Em transações, implemente locks ou mecanismos de sincronização para evitar mudanças entre a validação e execução da ação.

CVE-2026-21523HIGHGitHub Copilot and Visual Studio Code Remote Code Execution VulnerabilityEPSS 0.8%CVE-2024-29062HIGHSecure Boot Security Feature Bypass VulnerabilityEPSS 0.7%CVE-2023-38041HIGHA logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a particular process flEPSS 0.7%CVE-2022-23029—On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when aEPSS 0.7%CVE-2026-37531CRITICALAGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-367EPSS 0.7%CVE-2022-23181—Local privilege escalation with FileStoreEPSS 0.7%CVE-2025-49730HIGHMicrosoft Windows QoS Scheduler Driver Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2019-11774—Prior to 0.1, all builds of Eclipse OMR contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop EPSS 0.7%CVE-2022-26387HIGHWhen installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underEPSS 0.7%CVE-2024-30471MEDIUMApache StreamPipes: Potential creation of multiple identical accountsEPSS 0.7%CVE-2022-22753HIGHA Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrarEPSS 0.7%CVE-2026-123835MEDIUMIn JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race conditionEPSS 0.6%CVE-2023-38141HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2025-3464HIGHA race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issue, potentially leadinEPSS 0.6%CVE-2026-78319CRITICALTOCTOU Vulnerability in file exchangeEPSS 0.6%CVE-2024-27297MEDIUMNix Corruption of fixed-output derivationsEPSS 0.6%CVE-2022-34830HIGHAn Arm product family through 2022-06-29 has a TOCTOU Race Condition that allows non-privileged user to make improper GPU processing operatiEPSS 0.6%CVE-2026-66314MEDIUMMicrosoft Edge (Chromium-based) Information Disclosure VulnerabilityEPSS 0.6%CVE-2026-82761CRITICALMagic link single-use tokens replayable via TOCTOU race in AshAuthenticationEPSS 0.6%CVE-2026-41651HIGHPackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as rootEPSS 0.5%