Falhas do tipo CWE-367

799 resultados

Condição de corrida entre verificação e uso (TOCTOU)

A aplicação verifica uma condição (ex: arquivo existe, usuário tem permissão) e depois atua sobre ela, mas entre a verificação e a ação outro processo pode alterar o estado. Um atacante explora esse intervalo para burlar controles de segurança ou acessar recursos que não deveria.

Exemplo

Um programa verifica se um arquivo é seguro para ler (if (arquivo_existe && nao_eh_symlink)), depois abre e processa. Um atacante substitui o arquivo por um symlink apontando para /etc/passwd entre a verificação e a leitura, conseguindo acessar dados sensíveis.

Como mitigar

Use operações atômicas do SO (open com flags O_NOFOLLOW, O_EXCL; fstat em vez de stat; operações que verificam e atuam em uma única chamada). Implemente locks/mutexes se lógica complexa for necessária, e valide o estado novamente após adquirir recurso.

CVE-2026-53806HIGHOpenClaw < 2026.5.12 - Shell Option Parsing Bypass in Exec RevalidationEPSS 0.4%CVE-2026-47621MEDIUMNVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initializationEPSS 0.4%CVE-2026-53518HIGHBetter Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code RedemptionEPSS 0.4%CVE-2023-37867LOWWordPress Yet Another Stars Rating Plugin <= 3.3.8 is vulnerable to Race ConditionEPSS 0.4%CVE-2024-45120LOWAdobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)EPSS 0.4%CVE-2023-27327HIGHParallels Desktop Toolgate Time-Of-Check Time-Of-Use Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2022-45809MEDIUMWordPress Thumbs Rating Plugin <= 5.0.0 is vulnerable to Race ConditionEPSS 0.4%CVE-2026-73179HIGHApache CXF: JPA authorization-code consume is non-atomicEPSS 0.4%CVE-2024-36304HIGHA Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalaEPSS 0.4%CVE-2025-43276MEDIUMA logic error was addressed with improved error handling. This issue is fixed in macOS Sequoia 15.6. iCloud Private Relay may not activate wEPSS 0.4%CVE-2023-44188MEDIUMJunos OS: jkdsd crash due to multiple telemetry requestsEPSS 0.4%CVE-2021-26356HIGHA TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data cEPSS 0.4%CVE-2025-24430LOWAdobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)EPSS 0.4%CVE-2025-24432LOWAdobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)EPSS 0.4%CVE-2026-65183HIGHApache Tomcat: TOCTOU when setting specific permissions for Unix Domain SocketsEPSS 0.4%CVE-2026-68488CRITICALA Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to rootEPSS 0.4%CVE-2021-46792MEDIUMTime-of-check Time-of-use (TOCTOU) in the BIOS2PSP command may allow an attacker with a malicious BIOS to create a race condition causing thEPSS 0.4%CVE-2026-67607HIGHLightFTP 2.3.1 Race Condition DoS via worker_thread_cleanupEPSS 0.4%CVE-2025-46336MEDIUMRack session gets restored after deletionEPSS 0.4%CVE-2026-80353HIGHApache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connectorEPSS 0.4%