Falhas do tipo CWE-367

680 resultados

Condição de corrida entre verificação e uso (TOCTOU)

A aplicação verifica uma condição (ex: arquivo existe, usuário tem permissão) e depois atua sobre ela, mas entre a verificação e a ação outro processo pode alterar o estado. Um atacante explora esse intervalo para burlar controles de segurança ou acessar recursos que não deveria.

Exemplo

Um programa verifica se um arquivo é seguro para ler (if (arquivo_existe && nao_eh_symlink)), depois abre e processa. Um atacante substitui o arquivo por um symlink apontando para /etc/passwd entre a verificação e a leitura, conseguindo acessar dados sensíveis.

Como mitigar

Use operações atômicas do SO (open com flags O_NOFOLLOW, O_EXCL; fstat em vez de stat; operações que verificam e atuam em uma única chamada). Implemente locks/mutexes se lógica complexa for necessária, e valide o estado novamente após adquirir recurso.

CVE-2025-71215HIGHA time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent iCore service signature verification could allow a local aEPSS 0.3%CVE-2026-45208HIGHA time-of-check time-of-use vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installaEPSS 0.3%CVE-2021-31422HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.1-49141. An attacker muEPSS 0.3%CVE-2026-54754CRITICALKlever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)EPSS 0.3%CVE-2026-87433HIGHRace condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypaEPSS 0.3%CVE-2026-67607HIGHLightFTP 2.3.1 Race Condition DoS via worker_thread_cleanupEPSS 0.3%CVE-2026-25728CRITICALClipBucket v5 Affected by Remote Code Execution via Avatar/Background File Upload Race ConditionEPSS 0.3%CVE-2023-3891HIGHLapce v0.2.8 - Privilege escalation via Race ConditionEPSS 0.3%CVE-2023-2007—The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations EPSS 0.3%CVE-2022-36929HIGHLocal Privilege Escalation in Zoom Rooms for Windows ClientsEPSS 0.3%CVE-2026-20677CRITICALA race condition was addressed with improved handling of symbolic links. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iEPSS 0.3%CVE-2020-8016MEDIUMrace condition in the packaging of texlive-filesystenEPSS 0.3%CVE-2026-53801HIGHrsync < 3.5.0 Symlink Race Condition Directory TraversalEPSS 0.3%CVE-2026-50631HIGHApache CXF: OAuth2: TOCTOU Race Condition in Refresh Token ProcessingEPSS 0.3%CVE-2025-54895HIGHSPNEGO Extended Negotiation (NEGOEX) Security Mechanism Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2024-11222MEDIUMTime-of-check Time-of-use (TOCTOU) Race Condition in GitLabEPSS 0.3%CVE-2021-31427HIGHThis vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. An EPSS 0.3%CVE-2026-53708MEDIUMContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)EPSS 0.3%CVE-2026-21240HIGHWindows HTTP.sys Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2022-33270HIGHTime-of-check time-of-use race condition in ModemEPSS 0.3%