CWE-367: TOCTTOU
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Also known as Time-of-check Time-of-use (TOCTOU) Race Condition, TOCCTOU.
A kind of CWE-362 Race Condition.
From the CWE List. © The MITRE Corporation.
Newest
- intego log reporterIntego Log Reporter TOCTOU Local Privilege Escalation8.5 High
- apple ipados, macos, visionos +2 more +4 moreA race condition was addressed with improved handling of symbolic links. This issue is fixed in...9.0 Critical
- amd instinct™ mi210, instinct™ mi250, instinct™ mi300a +9 more +11 moreA Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow...7.1 High
- amd instinct™ mi210, instinct™ mi250, instinct™ mi300a +7 more +9 moreA Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow...7.1 High
- amd ryzen™ 7000 series desktop processors, ryzen™ 7045 series mobile processors with radeon™ graphics, ryzen™ 8000 series desktop processors +3 more +5 moreA Time-of-check time-of-use (TOCTOU) race condition in the SMM communications buffer could allow...4.6 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +18 more +20 moreWindows HTTP.sys Elevation of Privilege Vulnerability7.8 High
- microsoft visual studio code, visual studio code copilot chat extension +1 moreGitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability8.0 High
- oxygenz clipbucket, macwarrior clipbucket-v5 +1 moreClipBucket v5 Affected by Remote Code Execution via Avatar/Background File Upload Race Condition9.3 Critical
- eset management agentLocal privilege escalation in ESET Management Agent for Windows8.3 High
- nyariv sandboxjsSandboxJS has a sandbox escape via TOCTOU bug on keys in property accesses10.0 Critical
- lfprojects mcp typescript sdk, modelcontextprotocol typescript-sdk, red hat ansible automation platform 2.6 +2 more@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse7.1 High
- n8nn8n Improper File Access Controls Allow Arbitrary File Read by Authenticated Users9.4 Critical
- dr.buho buhocleanerBuhoCleaner 1.15.2 - Local Privilege Escalation via PID reuse attack7.3 High
- native instruments access, native-instruments native access +1 moreXPC Client Validation via PID leading to Local Privilege Escalation in Native Instruments Native Access7.8 High
- svenstaro miniserveminiserve affected by a TOCTOU and symlink race vulnerability6.8 Medium
- akeo rufusRufus has Local Privilege Escalation via TOCTOU Race Condition in Fido Script Handling7.3 High
- dell powerscale onefsDell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10,...3.5 Low
- red hat build of keycloak 26.4, build of keycloak 26.4.11, jboss enterprise application platform 8 +2 more +4 moreOrg.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race condition3.1 Low
- isaacs node-tar, tar, red hat confidential compute attestation +37 more +39 morenode-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS8.8 High
- hotwired turboTurbo Frame responses can restore stale session cookies4.8 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: MX10k Series: 'show system firmware' CLI command may lead to LC480 or LC2101 line card reset6.8 Medium
- linux, linux kernel +1 morehwmon: (w83791d) Convert macros to functions to avoid TOCTOU4.7 Medium
- akinloluwami outrayOutray cli is vulnerable to race conditions in tunnels creation6.3 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +29 more +31 moreWindows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +29 more +31 moreWindows Installer Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +23 more +25 moreWindows Kernel Memory Elevation of Privilege Vulnerability7.8 High
- tox-dev filelockfilelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock5.3 Medium
- qualcomm csra6620 firmware, csra6640 firmware, fastconnect 6200 firmware +80 more +82 moreTime-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver6.7 Medium
- qualcomm fastconnect 6200 firmware, fastconnect 6700 firmware, fastconnect 6900 firmware +72 more +74 moreTime-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver6.7 Medium
- qnap systems inc. qfinder pro mac, qsync for mac, qvpn device client for mac +2 moreQfinder Pro, Qsync, QVPN4.4 Medium
- sevencs ec2007 kernel, orca g2 +1 moreA local privilege escalation vulnerability exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5...7.0 High
- nestjs nestNest has a Fastify URL Encoding Middleware Bypass (TOCTOU)6.9 Medium
- ibm concertMultiple Vulnerabilities in IBM Concert Software.7.7 High
- versa networks sase client for windows, versa-networks sase client +1 moreVersa SASE Client for Windows < 7.9.5 Arbitrary Folder Deletion Leading to Local Privilege Escalation8.5 High
- bullwall server intrusion protectionBullWall Server Intrusion Protection (SIP) initialization race condition7.7 High
- bullwall server intrusion protectionBullWall Server Intrusion Protection RDP MFA connection delay7.7 High
- tox-dev filelockfilelock has TOCTOU race condition that allows symlink attacks during lock file creation6.3 Medium
- gitlabTime-of-check Time-of-use (TOCTOU) Race Condition in GitLab7.7 High
- osc ondemandOpen OnDemand allowlist bypass using symlinks in directory downloads (TOCTOU)4.3 Medium
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - TOCTOU bug affecting psFWMemContext->uiPageCatBaseRegSet7.4 High
- No product listedTime-of-check time-of-use race condition for some Intel Ethernet Adapter Complete Driver Pack...5.1 Medium
- No product listedTime-of-check time-of-use race condition for some ACAT before version 3.13 within Ring 3: User...4.1 Medium
- avast antivirus, (free/premiium/ultimeat) antivirus, avg (free/inernet security/ultimate) antivirus +1 more +3 moreDouble fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 on windows allows local...9.9 Critical
- jetbrains dottrace, resharper, resharper, rider and dottrace +1 more +3 moreIn JetBrains dotTrace before 2025.2.5 local privilege escalation possible via race condition4.2 Medium
- manager-io managerManager-io/Manager: Complete Bypass of SSRF Protection via Time-of-Check Time-of-Use (TOCTOU)10.0 Critical
- mediatek software development kit, mediatek, inc. mt7902, mt7920, mt7921, mt7922, mt7925, mt7927 +1 moreIn wlan STA driver, there is a possible out of bounds read due to a race condition. This could...4.7 Medium
- nagios xiNagios XI < 2011R1.9 Race Conditions in Crontab Install Scripts LPE7.3 High
- isaacs node-tarnode-tar vulnerable to race condition leading to uninitialized memory exposure6.1 Medium
- zheny-creator ytgrabber-tuiyt-grabber-tui local arbitrary file overwrite via TOCTOU race in config file creation6.3 Medium
- adobe creative cloud desktop, creative cloud +1 moreCreative Cloud Desktop | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)5.6 Medium
- Show moreLoading…