CWE-367: TOCTTOU
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Also known as Time-of-check Time-of-use (TOCTOU) Race Condition, TOCCTOU.
A kind of CWE-362 Race Condition.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft windows defender for endpointA time-of-check-time-of-use (TOCTOU) race condition vulnerability was found in networkd...4.7 Medium
- foscam r2c application firmware, r2c system firmware +1 moreTime-of-check Time-of-use (TOCTOU) Race Condition vulerability in Foscam R2C IP camera running...9.1 Critical
- amazon aws client vpnAn issue was discovered in Amazon AWS VPN Client 2.0.0. A TOCTOU race condition exists during the...7.0 High
- logitech syncLogitech Sync desktop application prior to 2.4.574 - TOCTOU during installation leads to privelege escalation6.0 Medium
- dell powerscale onefs, emc powerscale onefs +1 moreDell PowerScale OneFS, versions 8.2.2-9.3.x, contain a time-of-check-to-time-of-use vulnerability...4.4 Medium
- google android, samsung mobile devices +1 moreUse after free vulnerability in dsp_context_unload_graph function of DSP driver prior to SMR Apr...2.9 Low
- mcafee total protection for windows, microsoft windows +1 moreMcAfee Total Protection (MTP) - File Deletion vulnerability7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen installing an add-on, Firefox verified the signature before prompting the user; but while...7.5 High
- jetbrains teamcityJetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race...8.1 High
- backblaze b2 command line toolB2 Command Line Tool TOCTOU application key disclosure4.7 Medium
- backblaze b2-sdk-python, b2 python software development kit +1 moreb2-sdk-python TOCTOU application key disclosure4.7 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused...7.1 High
- vmware esxi, fusion +1 moreVMware ESXi contains a TOCTOU (Time-of-check Time-of-use) vulnerability that exists in the way...7.5 High
- google tensorflowInsecure temporary file in Tensorflow7.1 High
- kubernetesBypass of Kubernetes API Server proxy TOCTOU2.2 Low
- apache tomcat, debian linux, oracle agile engineering data management +4 more +6 moreLocal privilege escalation with FileStore7.0 High
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +12 more +14 moreOn BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all...5.3 Medium
- apple macos, rust-lang rust, apple ipados +4 more +6 moreRace condition in std::fs::remove_dir_all in rustlang7.3 High
- google android, mediatek, inc. mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6877, mt6883, mt6885, mt6889, mt6891, mt6893, mt8185, mt8789, mt8791, mt8797 +1 moreIn vow driver, there is a possible memory corruption due to a race condition. This could lead to...6.4 Medium
- google chromeInsufficient data validation in Mojo in Google Chrome prior to 96.0.4664.110 allowed a remote...7.4 High
- google androidIn apusys, there is a possible out of bounds write due to a missing bounds check. This could lead...6.7 Medium
- plex media serverAn issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker (with a...7.0 High
- linux kernelA race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and...4.1 Medium
- intel crypto api toolkit for intel sgxTime-of-check time-of-use vulnerability in the Crypto API Toolkit for Intel(R) SGX may allow a...6.6 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, qualcomm aqt1000 firmware, qca6390 firmware +55 more +57 morePossible memory corruption due to Improper handling of hypervisor unmap operations for concurrent...7.8 High
- realtek rtsupx usb utility driverRtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows...7.8 High
- calibre-ebook calibreRace condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged...8.1 High
- cisco anyconnect secure mobility clientCisco AnyConnect Secure Mobility Client for Linux and Mac OS with VPN Posture (HostScan) Module Shared Library Hijacking Vulnerability7.0 High
- zoom plugin for microsoft outlookAll versions of the Zoom Plugin for Microsoft Outlook for MacOS before 5.3.52553.0918 contain a...7.5 High
- palo alto networks pan-osPAN-OS: Unsigned Code Execution During Plugin Installation Race Condition Vulnerability7.2 High
- qualcomm, inc. snapdragon auto, snapdragon connectivity, snapdragon industrial iot, snapdragon mobile, qualcomm qca6174a firmware, qca6574 firmware +39 more +41 morePossible null pointer dereference due to race condition between timeline fence signal and time...8.4 High
- nervos ckbRPC call failure in ckb9.8 Critical
- juniper junos, juniper networks junos os, junos os evolved +2 moreJunos OS: User-defined ARP Policer isn't applied on Aggregated Ethernet (AE) interface until firewall process is restarted6.5 Medium
- huawei emui, magic ui +1 moreThere is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Huawei Smartphone....8.1 High
- thephpleague flysystem, fedoraproject fedora +1 moreTime-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem9.8 Critical
- cisco anyconnect secure mobility clientCisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability7.0 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm aqt1000 firmware, ar8031 firmware +109 more +111 moreWhile waiting for a response to a callback or listener request, non-secure clients can change...7.8 High
- linuxfoundation runc, fedoraproject fedora +1 moremount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs8.5 High
- mcafee endpoint security for linux threat prevention, mcafee,llc mcafee endpoint security (ens) for linux +1 moreBy exploiting a time of check to time of use (TOCTOU) race condition during the Endpoint Security...8.2 High
- dell idrac9 firmware, integrated dell remote access controller (idrac) +1 moreDell EMC iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race...5.9 Medium
- parallels desktopThis vulnerability allows local attackers to disclose sensitive information on affected...7.3 High
- parallels desktopThis vulnerability allows local attackers to escalate privileges on affected installations of...7.5 High
- linux kernelarch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD...7.4 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon industrial iot, snapdragon mobile, qualcomm aqt1000 firmware, fsm10055 firmware +178 more +180 morePotential arbitrary memory corruption when the qseecom driver updates ion physical addresses in...6.4 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon industrial iot, snapdragon mobile, snapdragon wired infrastructure and networking, qualcomm aqt1000 firmware, ar8035 firmware +129 more +131 moreWhile processing storage SCM commands there is a time of check or time of use window where a...6.4 Medium
- mozilla firefoxFirefox for Android suffered from a time-of-check-time-of-use vulnerability that allowed a...5.3 Medium
- firejail project firejail, debian linux +1 moreFirejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is...7.8 High
- qemu, debian linux +1 moreA race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2...7.5 High
- madshi madcodehook, cisco advanced malware protection, morphisec unified threat prevention platform +2 moreA TOCTOU vulnerability exists in madCodeHook before 2020-07-16 that allows local attackers to...7.0 High
- jenkinsTime-of-check Time-of-use (TOCTOU) Race Condition in Jenkins5.3 Medium
- Show moreLoading…