Falhas do tipo CWE-367

799 resultados

Condição de corrida entre verificação e uso (TOCTOU)

A aplicação verifica uma condição (ex: arquivo existe, usuário tem permissão) e depois atua sobre ela, mas entre a verificação e a ação outro processo pode alterar o estado. Um atacante explora esse intervalo para burlar controles de segurança ou acessar recursos que não deveria.

Exemplo

Um programa verifica se um arquivo é seguro para ler (if (arquivo_existe && nao_eh_symlink)), depois abre e processa. Um atacante substitui o arquivo por um symlink apontando para /etc/passwd entre a verificação e a leitura, conseguindo acessar dados sensíveis.

Como mitigar

Use operações atômicas do SO (open com flags O_NOFOLLOW, O_EXCL; fstat em vez de stat; operações que verificam e atuam em uma única chamada). Implemente locks/mutexes se lógica complexa for necessária, e valide o estado novamente após adquirir recurso.

CVE-2021-31427HIGHThis vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. An EPSS 0.3%CVE-2026-113115HIGHRace condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer pEPSS 0.3%CVE-2022-33270HIGHTime-of-check time-of-use race condition in ModemEPSS 0.3%CVE-2026-87433HIGHRace condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypaEPSS 0.3%CVE-2026-113041HIGHRace condition in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain cross-origEPSS 0.3%CVE-2026-113008HIGHRace condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer pEPSS 0.3%CVE-2026-113239HIGHRace condition in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data EPSS 0.3%CVE-2023-2007—The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations EPSS 0.3%CVE-2026-21240HIGHWindows HTTP.sys Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2023-33156MEDIUMMicrosoft Defender Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-50631HIGHApache CXF: OAuth2: TOCTOU Race Condition in Refresh Token ProcessingEPSS 0.3%CVE-2023-24861HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-113218HIGHRace condition in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process anEPSS 0.3%CVE-2026-83504MEDIUMWindows SmartScreen Information Disclosure VulnerabilityEPSS 0.3%CVE-2021-34986HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.5.0 (49183). An attacker EPSS 0.3%CVE-2026-25738MEDIUMIndico has Server-Side Request Forgery (SSRF) in multiple placesEPSS 0.3%CVE-2026-113335HIGHRace condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web oEPSS 0.3%CVE-2026-91712HIGHRace condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer prEPSS 0.3%CVE-2026-113141HIGHRace condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer pEPSS 0.3%CVE-2026-75524MEDIUMOpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agentEPSS 0.3%