Falhas do tipo CWE-367

680 resultados

Condição de corrida entre verificação e uso (TOCTOU)

A aplicação verifica uma condição (ex: arquivo existe, usuário tem permissão) e depois atua sobre ela, mas entre a verificação e a ação outro processo pode alterar o estado. Um atacante explora esse intervalo para burlar controles de segurança ou acessar recursos que não deveria.

Exemplo

Um programa verifica se um arquivo é seguro para ler (if (arquivo_existe && nao_eh_symlink)), depois abre e processa. Um atacante substitui o arquivo por um symlink apontando para /etc/passwd entre a verificação e a leitura, conseguindo acessar dados sensíveis.

Como mitigar

Use operações atômicas do SO (open com flags O_NOFOLLOW, O_EXCL; fstat em vez de stat; operações que verificam e atuam em uma única chamada). Implemente locks/mutexes se lógica complexa for necessária, e valide o estado novamente após adquirir recurso.

CVE-2024-34528HIGHWordOps through 3.20.0 has a wo/cli/plugins/stack_pref.py TOCTOU race condition because the conf_path os.open does not use a mode parameter EPSS 0.2%CVE-2026-47746HIGHMisskey: JSON-LD signature validation + compaction is vulnerable to timing attacksEPSS 0.2%CVE-2022-26522HIGHThe socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to executeEPSS 0.2%CVE-2023-22397MEDIUMJunos OS Evolved: PTX10003: An attacker sending specific genuine packets will cause a memory leak in the PFE leading to a Denial of ServiceEPSS 0.2%CVE-2026-35362LOWuutils coreutils Missing TOCTOU Protection on Non-Linux Unix Platforms in Safe Traversal ModuleEPSS 0.2%CVE-2026-31824HIGHSylius has a Promotion Usage Limit Bypass via Race ConditionEPSS 0.2%CVE-2026-55537HIGHPraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114EPSS 0.2%CVE-2026-27128MEDIUMCraft CMS's race condition in Token Service potentially allows for token usage greater than the token limitEPSS 0.2%CVE-2023-20523MEDIUMTOCTOU in the ASP may allow a physical attacker to write beyond the buffer bounds, potentially leading to a loss of integrity or denial of sEPSS 0.2%CVE-2021-1567HIGHCisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking VulnerabilityEPSS 0.2%CVE-2021-34788HIGHCisco AnyConnect Secure Mobility Client for Linux and Mac OS with VPN Posture (HostScan) Module Shared Library Hijacking VulnerabilityEPSS 0.2%CVE-2026-33624LOWParse Server: MFA recovery code single-use bypass via concurrent requestsEPSS 0.2%CVE-2026-79196MEDIUMRace condition in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitivEPSS 0.2%CVE-2022-0915MEDIUMLogitech Sync desktop application prior to 2.4.574 - TOCTOU during installation leads to privelege escalationEPSS 0.2%CVE-2024-50592HIGHLocal Privilege Escalation via Race ConditionEPSS 0.2%CVE-2026-40896MEDIUMOpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section LookupEPSS 0.2%CVE-2026-56708MEDIUMGrav API Plugin before 1.0.16 SSRF via DNS RebindingEPSS 0.2%CVE-2026-87517LOWRace condition in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypassEPSS 0.2%CVE-2023-46649MEDIUMRace Condition allows Administrative Access on Organization RepositoriesEPSS 0.2%CVE-2026-0924HIGHBuhoCleaner 1.15.2 - Local Privilege Escalation via PID reuse attackEPSS 0.2%