Falhas do tipo CWE-367

799 resultados

Condição de corrida entre verificação e uso (TOCTOU)

A aplicação verifica uma condição (ex: arquivo existe, usuário tem permissão) e depois atua sobre ela, mas entre a verificação e a ação outro processo pode alterar o estado. Um atacante explora esse intervalo para burlar controles de segurança ou acessar recursos que não deveria.

Exemplo

Um programa verifica se um arquivo é seguro para ler (if (arquivo_existe && nao_eh_symlink)), depois abre e processa. Um atacante substitui o arquivo por um symlink apontando para /etc/passwd entre a verificação e a leitura, conseguindo acessar dados sensíveis.

Como mitigar

Use operações atômicas do SO (open com flags O_NOFOLLOW, O_EXCL; fstat em vez de stat; operações que verificam e atuam em uma única chamada). Implemente locks/mutexes se lógica complexa for necessária, e valide o estado novamente após adquirir recurso.

CVE-2026-71210MEDIUMmealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata AccessEPSS 0.2%CVE-2026-41337MEDIUMOpenClaw < 2026.3.31 - Callback Origin Mutation in Plivo Voice-call ReplayEPSS 0.2%CVE-2026-123119LOWSymfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)EPSS 0.2%CVE-2026-91748HIGHRace condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer prEPSS 0.2%CVE-2026-96939HIGHServicing Stack Updates Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-83750HIGHWindows Error Reporting Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-5303MEDIUMThe ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. ThEPSS 0.2%CVE-2026-113329MEDIUMRace condition in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a local attacker to execute arbitrary code outside theEPSS 0.2%CVE-2026-122321HIGHKyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification BypassEPSS 0.2%CVE-2026-79196MEDIUMRace condition in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitivEPSS 0.2%CVE-2026-35648LOWOpenClaw < 2026.3.22 - Policy Bypass via Unvalidated Queued Node ActionsEPSS 0.2%CVE-2026-78991MEDIUMRace condition in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to oEPSS 0.2%CVE-2026-54242MEDIUMStatamic: Server-Side Request Forgery via Glide (DNS rebinding)EPSS 0.2%CVE-2024-28183MEDIUMAnti Rollback bypass with physical access and TOCTOU attackEPSS 0.2%CVE-2026-62212MEDIUMOpenClaw < 2026.5.28 Authentication Bypass via safeFetchEPSS 0.2%CVE-2026-83697MEDIUMWindows Modern Device Management (MDM) Tampering VulnerabilityEPSS 0.2%CVE-2026-88924HIGHGvfs: gvfs-admin socket ownership race permits local rootEPSS 0.2%CVE-2024-6029MEDIUMTesla Model S Iris Modem Race Condition Firewall Bypass VulnerabilityEPSS 0.2%CVE-2020-2032HIGHGlobalProtect App: File race condition vulnerability leads to local privilege escalation during upgradeEPSS 0.2%CVE-2026-83871HIGHMicrosoft OpenSSH for Windows Elevation of Privilege VulnerabilityEPSS 0.2%