Falhas do tipo CWE-367

680 resultados

Condição de corrida entre verificação e uso (TOCTOU)

A aplicação verifica uma condição (ex: arquivo existe, usuário tem permissão) e depois atua sobre ela, mas entre a verificação e a ação outro processo pode alterar o estado. Um atacante explora esse intervalo para burlar controles de segurança ou acessar recursos que não deveria.

Exemplo

Um programa verifica se um arquivo é seguro para ler (if (arquivo_existe && nao_eh_symlink)), depois abre e processa. Um atacante substitui o arquivo por um symlink apontando para /etc/passwd entre a verificação e a leitura, conseguindo acessar dados sensíveis.

Como mitigar

Use operações atômicas do SO (open com flags O_NOFOLLOW, O_EXCL; fstat em vez de stat; operações que verificam e atuam em uma única chamada). Implemente locks/mutexes se lógica complexa for necessária, e valide o estado novamente após adquirir recurso.

CVE-2026-82238LOWfilebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploadsEPSS 0.2%CVE-2026-73410HIGHBudibase: SSRF via DNS rebinding in the REST datasource integrationEPSS 0.2%CVE-2026-48344HIGHGoCart | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)EPSS 0.2%CVE-2026-88924HIGHGvfs: gvfs-admin socket ownership race permits local rootEPSS 0.2%CVE-2026-22281LOWDell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starEPSS 0.2%CVE-2026-19975LOWAzuriom CMS Money Transfer ProfileController.php transferMoney toctouEPSS 0.2%CVE-2024-3292HIGHRace ConditionEPSS 0.2%CVE-2025-46805MEDIUMScreen has a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-rootEPSS 0.2%CVE-2026-30332HIGHA Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalaEPSS 0.2%CVE-2023-4155MEDIUMSev-es / sev-snp vmgexit double fetch vulnerabilityEPSS 0.2%CVE-2024-13960HIGHLink Following Local Privilege Escalation Vulnerability in AVG TuneUp Version 23.4EPSS 0.2%CVE-2022-31640HIGHPotential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escEPSS 0.2%CVE-2026-70667MEDIUMLemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)EPSS 0.2%CVE-2026-5303MEDIUMThe ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. ThEPSS 0.2%CVE-2024-13961HIGHAvast Cleanup Premium TuneupSvc Link Following Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2022-31641HIGHPotential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escEPSS 0.2%CVE-2023-1585MEDIUMAvast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the Quarantine process, leadiEPSS 0.2%CVE-2023-6803MEDIUMRace Condition allows Unauthorized Outside CollaboratorEPSS 0.2%CVE-2026-71272HIGHMemos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()EPSS 0.2%CVE-2022-44651HIGHA Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalaEPSS 0.2%