Fallos del tipo CWE-367

680 resultados

Condição de corrida entre verificação e uso (TOCTOU)

Ocorre quando o código verifica uma condição (ex: permissão de arquivo, saldo bancário) e depois usa o recurso, mas entre a verificação e o uso algo muda. Um atacante explora essa janela de tempo para alterar o estado, burlar a validação e executar operações não autorizadas.

Ejemplo

Um processo verifica se tem permissão de leitura em um arquivo, mas antes de ler, um outro processo muda o arquivo de lugar ou altera suas permissões. O primeiro processo tenta ler o que acredita ser o arquivo autorizado, mas na verdade acessa outro recurso.

Cómo mitigar

Use operações atômicas que combinam verificação e acesso em um único passo (ex: abrir arquivo com flags específicas). Em transações, implemente locks ou mecanismos de sincronização para evitar mudanças entre a validação e execução da ação.

CVE-2026-56648HIGHWindows NFS Server Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-47290HIGHContainerd vulnerable to host filesystem access during image unpackEPSS 0.5%CVE-2024-1729MEDIUMTiming Attack Vulnerability in gradio-app/gradioEPSS 0.5%CVE-2020-15702HIGHTOCTOU in apportEPSS 0.5%CVE-2026-25641CRITICALSandboxJS has a sandbox escape via TOCTOU bug on keys in property accessesEPSS 0.5%CVE-2024-39936HIGHAn issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6EPSS 0.5%CVE-2022-48618HIGHThe issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. AEPSS 0.5%KEVCVE-2024-49768CRITICALWaitress has request processing race condition in HTTP pipelining with invalid first requestEPSS 0.5%CVE-2025-48818MEDIUMWindows BitLocker Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2022-22220MEDIUMJunos OS and Junos OS Evolved: Due to a race condition the rpd process can crash upon receipt of a BGP update message containing flow spec routeEPSS 0.5%CVE-2022-22225MEDIUMJunos OS and Junos OS Evolved: In a BGP multipath scenario, when one of the contributing routes is flapping often and rapidly, rpd may crashEPSS 0.5%CVE-2026-58299HIGHMicrosoft Edge for Android Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-86861MEDIUMpgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment checkEPSS 0.5%CVE-2026-41651HIGHPackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as rootEPSS 0.5%CVE-2026-24260HIGHNVIDIA Container Toolkit for Linux contains a vulnerability where an attacker could cause a time-of-check time-of-use race condition. A succEPSS 0.5%CVE-2026-65183HIGHApache Tomcat: TOCTOU when setting specific permissions for Unix Domain SocketsEPSS 0.5%CVE-2024-2440MEDIUMRace Condition was identified in GitHub Enterprise Server that allowed maintaining admin permissionsEPSS 0.5%CVE-2024-49046HIGHWindows Win32 Kernel Subsystem Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-27127HIGHCraft CMS has Cloud Metadata SSRF Protection Bypass via DNS RebindingEPSS 0.4%CVE-2022-3093HIGHThis vulnerability allows physical attackers to execute arbitrary code on affected Tesla vehicles. Authentication is not required to exploitEPSS 0.4%