Falhas do tipo CWE-367

763 resultados

Condição de corrida entre verificação e uso (TOCTOU)

A aplicação verifica uma condição (ex: arquivo existe, usuário tem permissão) e depois atua sobre ela, mas entre a verificação e a ação outro processo pode alterar o estado. Um atacante explora esse intervalo para burlar controles de segurança ou acessar recursos que não deveria.

Exemplo

Um programa verifica se um arquivo é seguro para ler (if (arquivo_existe && nao_eh_symlink)), depois abre e processa. Um atacante substitui o arquivo por um symlink apontando para /etc/passwd entre a verificação e a leitura, conseguindo acessar dados sensíveis.

Como mitigar

Use operações atômicas do SO (open com flags O_NOFOLLOW, O_EXCL; fstat em vez de stat; operações que verificam e atuam em uma única chamada). Implemente locks/mutexes se lógica complexa for necessária, e valide o estado novamente após adquirir recurso.

CVE-2025-46805MEDIUMScreen has a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-rootEPSS 0.2%CVE-2026-30332HIGHA Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalaEPSS 0.2%CVE-2024-50592HIGHLocal Privilege Escalation via Race ConditionEPSS 0.2%CVE-2022-0915MEDIUMLogitech Sync desktop application prior to 2.4.574 - TOCTOU during installation leads to privelege escalationEPSS 0.2%CVE-2023-46649MEDIUMRace Condition allows Administrative Access on Organization RepositoriesEPSS 0.2%CVE-2026-40896MEDIUMOpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section LookupEPSS 0.2%CVE-2024-13961HIGHAvast Cleanup Premium TuneupSvc Link Following Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2026-56822HIGHNetty: TOCTOU in OcspServerCertificateValidatorEPSS 0.2%CVE-2024-13960HIGHLink Following Local Privilege Escalation Vulnerability in AVG TuneUp Version 23.4EPSS 0.2%CVE-2025-46328LOWNodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration fileEPSS 0.2%CVE-2026-48344HIGHGoCart | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)EPSS 0.2%CVE-2024-3292HIGHRace ConditionEPSS 0.2%CVE-2023-4155MEDIUMSev-es / sev-snp vmgexit double fetch vulnerabilityEPSS 0.2%CVE-2026-22281LOWDell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starEPSS 0.2%CVE-2026-49262LOWAimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxyEPSS 0.2%CVE-2026-41702HIGHTOCTOU local privilege escalation vulnerabilityEPSS 0.2%CVE-2022-31641HIGHPotential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escEPSS 0.2%CVE-2022-31640HIGHPotential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escEPSS 0.2%CVE-2024-13944HIGHLink Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate (Also affects Avast CleanUp and AVG TuneUp)EPSS 0.2%CVE-2026-18069MEDIUMIBM i is Affected By A Race Condition Vulnerability in SQL Query Engine []EPSS 0.2%