CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition (page 6)
Page 6 of 8 — CVEs classified under CWE-367, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-43777 | High | 7.8 | 2023-06-12 | Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code e… |
CVE-2022-27541 | High | 7.8 | 2023-06-12 | Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code e… |
CVE-2022-27539 | High | 7.8 | 2023-06-12 | Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code e… |
CVE-2023-25394 | High | 7.0 | 2023-05-17 | Videostream macOS app 0.5.0 and 0.4.3 has a Race Condition. The Updater privileged script attempts to update Videostream every 5 hours. |
CVE-2021-46792 | Medium | 5.9 | 2023-05-09 | Time-of-check Time-of-use (TOCTOU) in the BIOS2PSP command may allow an attacker with a malicious BIOS to create a race condition causing the ASP bootloader to… |
CVE-2021-26356 | High | 7.4 | 2023-05-09 | A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data corruption and infor… |
CVE-2022-38730 | Medium | 6.3 | 2023-04-27 | Docker Desktop for Windows before 4.6 allows attackers to overwrite any file through the windowscontainers/start dockerBackendV2 API by controlling the data-ro… |
CVE-2023-2007 | High | 7.8 | 2023-04-24 | The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An at… |
CVE-2023-1586 | Medium | 6.5 | 2023-04-19 | Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the restore process leading to arbitrary file cr… |
CVE-2023-1585 | Medium | 6.5 | 2023-04-19 | Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the Quarantine process, leading to arbitrary fil… |
CVE-2022-33270 | High | 7.5 | 2023-04-13 | Transient DOS due to time-of-check time-of-use race condition in Modem while processing RRC Reconfiguration message. |
CVE-2023-0006 | Medium | 6.3 | 2023-04-12 | A local file deletion vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a user to delete system files from the endpoint with… |
CVE-2022-43946 | High | 7.5 | 2023-04-11 | Multiple vulnerabilities including an incorrect permission assignment for critical resource [CWE-732] vulnerability and a time-of-check time-of-use (TOCTOU) ra… |
CVE-2022-3093 | Medium | 6.4 | 2023-03-29 | This vulnerability allows physical attackers to execute arbitrary code on affected Tesla vehicles. Authentication is not required to exploit this vulnerability… |
CVE-2022-36980 | High | 8.1 | 2023-03-29 | This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is requir… |
CVE-2023-0778 | Medium | 6.8 | 2023-03-27 | A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while… |
CVE-2023-22883 | High | 7.2 | 2023-03-16 | Zoom Client for IT Admin Windows installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit… |
CVE-2023-24861 | High | 7.0 | 2023-03-14 | Windows Graphics Component Elevation of Privilege Vulnerability |
CVE-2023-23389 | Medium | 6.3 | 2023-03-14 | Microsoft Defender Elevation of Privilege Vulnerability |
CVE-2022-33257 | Critical | 9.3 | 2023-03-10 | Memory corruption in Core due to time-of-check time-of-use race condition during dump collection in trust zone. |
CVE-2023-20623 | Medium | 6.4 | 2023-03-07 | In ion, there is a possible escalation of privilege due to improper locking. This could lead to local escalation of privilege with no additional execution priv… |
CVE-2023-20620 | Medium | 4.1 | 2023-03-07 | In adsp, there is a possible escalation of privilege due to a logic error. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2023-23520 | Medium | 5.9 | 2023-02-27 | A race condition was addressed with additional validation. This issue is fixed in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. A user… |
CVE-2022-32477 | High | 7.0 | 2023-02-15 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the FvbServicesRuntimeDxe shared buffer used by SMM and non-SMM code co… |
CVE-2022-32475 | High | 7.0 | 2023-02-15 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the VariableRuntimeDxe shared buffer used by SMM and non-SMM code could… |
CVE-2022-32469 | High | 7.0 | 2023-02-15 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the PnpSmm shared buffer used by SMM and non-SMM code could cause TOCTO… |
CVE-2022-32953 | High | 7.0 | 2023-02-15 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the SdHostDriver buffer used by SMM and non-SMM code could cause TOCTOU… |
CVE-2022-32476 | High | 7.0 | 2023-02-15 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the AhciBusDxe shared buffer used by SMM and non-SMM code could cause T… |
CVE-2022-32473 | High | 7.0 | 2023-02-15 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the HddPassword shared buffer used by SMM and non-SMM code could cause… |
CVE-2022-32470 | High | 7.0 | 2023-02-15 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the FwBlockServiceSmm shared buffer used by SMM and non-SMM code could… |
CVE-2022-32955 | High | 7.0 | 2023-02-15 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the NvmExpressDxe buffer used by SMM and non-SMM code could cause TOCTO… |
CVE-2022-32954 | High | 7.0 | 2023-02-15 | An issue was discovered in Insyde InsydeH2O with kernel 5.1 through 5.5. DMA attacks on the SdMmcDevice buffer used by SMM and non-SMM code could cause TOCTOU… |
CVE-2022-32478 | High | 7.0 | 2023-02-15 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the IdeBusDxe shared buffer used by SMM and non-SMM code could cause TO… |
CVE-2022-32474 | High | 7.0 | 2023-02-15 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the StorageSecurityCommandDxe shared buffer used by SMM and non-SMM cod… |
CVE-2022-32471 | High | 7.0 | 2023-02-15 | An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. The IhisiDxe driver uses the command buffer to pass input and output data… |
CVE-2022-43779 | High | 7.0 | 2023-02-12 | A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS) which might… |
CVE-2022-27538 | High | 7.0 | 2023-02-01 | A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the BIOS for certain HP PC products which may allow arbitrary code execu… |
CVE-2022-34398 | High | 7.5 | 2023-02-01 | Dell BIOS contains a Time-of-check Time-of-use vulnerability. A local authenticated malicious user could\u00a0potentially exploit this vulnerability by using… |
CVE-2022-48191 | High | 7.0 | 2023-01-20 | A vulnerability exists in Trend Micro Maximum Security 2022 (17.7) wherein a low-privileged user can write a known malicious executable to a specific location… |
CVE-2023-22397 | Medium | 6.1 | 2023-01-13 | An Allocation of Resources Without Limits or Throttling weakness in the memory management of the Packet Forwarding Engine (PFE) on Juniper Networks Junos OS Ev… |
CVE-2023-20523 | Medium | 5.7 | 2023-01-11 | TOCTOU in the ASP may allow a physical attacker to write beyond the buffer bounds, potentially leading to a loss of integrity or denial of service. |
CVE-2021-46795 | Medium | 4.7 | 2023-01-11 | A TOCTOU (time-of-check to time-of-use) vulnerability exists where an attacker may use a compromised BIOS to cause the TEE OS to read memory out of bounds that… |
CVE-2023-21555 | High | 8.1 | 2023-01-10 | Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability |
CVE-2023-21537 | High | 7.8 | 2023-01-10 | Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability |
CVE-2022-36929 | High | 7.8 | 2023-01-09 | The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulner… |
CVE-2022-36927 | High | 8.8 | 2023-01-09 | Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerabi… |
CVE-2022-25716 | Medium | 6.7 | 2023-01-09 | Memory corruption in Multimedia Framework due to unsafe access to the data members |
CVE-2022-32638 | Medium | 6.4 | 2023-01-03 | In isp, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges need… |
CVE-2022-26387 | High | 7.5 | 2022-12-22 | When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file c… |
CVE-2022-22753 | High | 7.1 | 2022-12-22 | A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory. This c… |
CVE-2022-3590 | Medium | 5.9 | 2022-12-14 | WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP r… |
CVE-2022-44670 | High | 8.1 | 2022-12-13 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
CVE-2022-44651 | High | 7.0 | 2022-12-12 | A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on af… |
CVE-2022-39908 | Medium | 6.9 | 2022-12-08 | TOCTOU vulnerability in Samsung decoding library for video thumbnails prior to SMR Dec-2022 Release 1 allows local attacker to perform Out-Of-Bounds Write. |
CVE-2022-45842 | Medium | 5.3 | 2022-11-30 | Unauth. Race Condition vulnerability in WP ULike Plugin <= 4.6.4 on WordPress allows attackers to increase/decrease rating scores. |
CVE-2022-34830 | High | 7.5 | 2022-11-23 | An Arm product family through 2022-06-29 has a TOCTOU Race Condition that allows non-privileged user to make improper GPU processing operations to gain access… |
CVE-2022-30283 | High | 7.5 | 2022-11-15 | In UsbCoreDxe, tampering with the contents of the USB working buffer using DMA while certain USB transactions are in process leads to a TOCTOU problem that cou… |
CVE-2022-33986 | Medium | 6.4 | 2022-11-15 | DMA attacks on the parameter buffer used by the VariableRuntimeDxe software SMI handler could lead to a TOCTOU attack. DMA attacks on the parameter buffer used… |
CVE-2022-33985 | High | 7.0 | 2022-11-15 | DMA transactions which are targeted at input buffers used for the NvmExpressDxe software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA… |
CVE-2022-33984 | High | 7.0 | 2022-11-15 | DMA transactions which are targeted at input buffers used for the SdMmcDevice software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA tr… |
CVE-2022-33983 | High | 7.0 | 2022-11-15 | DMA transactions which are targeted at input buffers used for the NvmExpressLegacy software SMI handler could cause SMRAM corruption through a TOCTOU attack. D… |
CVE-2022-33909 | High | 7.0 | 2022-11-15 | DMA transactions which are targeted at input buffers used for the HddPassword software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA tr… |
CVE-2022-33908 | High | 7.0 | 2022-11-15 | DMA transactions which are targeted at input buffers used for the SdHostDriver software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA t… |
CVE-2022-33906 | Medium | 6.4 | 2022-11-15 | DMA transactions which are targeted at input buffers used for the FwBlockServiceSmm software SMI handler could cause SMRAM corruption through a TOCTOU attack… |
CVE-2022-33905 | High | 7.0 | 2022-11-15 | DMA transactions which are targeted at input buffers used for the AhciBusDxe software SMI handler could cause SMRAM corruption (a TOCTOU attack). DMA transacti… |
CVE-2022-32267 | Medium | 6.4 | 2022-11-15 | DMA transactions which are targeted at input buffers used for the SmmResourceCheckDxe software SMI handler cause SMRAM corruption (a TOCTOU attack) DMA transac… |
CVE-2022-31243 | Medium | 6.4 | 2022-11-15 | Update description and links DMA transactions which are targeted at input buffers used for the software SMI handler used by the FvbServicesRuntimeDxe driver co… |
CVE-2022-30774 | Medium | 6.4 | 2022-11-15 | DMA attacks on the parameter buffer used by the PnpSmm driver could change the contents after parameter values have been checked but before they are used (a TO… |
CVE-2022-34325 | High | 7.8 | 2022-11-14 | DMA transactions which are targeted at input buffers used for the StorageSecurityCommandDxe software SMI handler could cause SMRAM corruption through a TOCTOU… |
CVE-2022-33982 | Medium | 6.4 | 2022-11-14 | DMA attacks on the parameter buffer used by the Int15ServiceSmm software SMI handler could lead to a TOCTOU attack on the SMI handler and lead to corruption of… |
CVE-2022-33907 | Medium | 6.4 | 2022-11-14 | DMA transactions which are targeted at input buffers used for the software SMI handler used by the IdeBusDxe driver could cause SMRAM corruption through a TOCT… |
CVE-2022-30773 | Medium | 6.4 | 2022-11-14 | DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been checked but before they are used (a… |
CVE-2022-21198 | High | 7.9 | 2022-11-11 | Time-of-check time-of-use race condition in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of priv… |
CVE-2022-32608 | Medium | 6.4 | 2022-11-08 | In jpeg, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2021-46853 | Medium | 5.9 | 2022-11-03 | Alpine before 2.25 allows remote attackers to cause a denial of service (application crash) when LIST or LSUB is sent before STARTTLS. |
CVE-2022-33214 | High | 8.4 | 2022-10-19 | Memory corruption in display due to time-of-check time-of-use of metadata reserved size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdr… |
CVE-2022-22225 | Medium | 5.9 | 2022-10-18 | A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows… |
CVE-2022-22220 | Medium | 5.9 | 2022-10-18 | A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Routing Protocol Daemon (rpd) of Juniper Networks Junos OS, Junos OS Evolved allows a netw… |
CVE-2022-41744 | High | 7.0 | 2022-10-10 | A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One Vulnerability Protection integrated component could allow a local attacker to escalate pr… |
CVE-2022-29800 | Medium | 4.7 | 2022-09-21 | A time-of-check-time-of-use (TOCTOU) race condition vulnerability was found in networkd-dispatcher. This flaw exists because there is a certain time between th… |
CVE-2022-25696 | High | 8.4 | 2022-09-16 | Memory corruption in display due to time-of-check time-of-use race condition during map or unmap in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivit… |
CVE-2022-22094 | High | 7.8 | 2022-09-16 | memory corruption in Kernel due to race condition while getting mapping reference in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Sn… |
CVE-2022-22093 | High | 7.8 | 2022-09-16 | Memory corruption or temporary denial of service due to improper handling of concurrent hypervisor operations to attach or detach IRQs from virtual interrupt s… |
CVE-2022-26859 | Medium | 6.1 | 2022-09-06 | Dell BIOS contains a race condition vulnerability. A local attacker could exploit this vulnerability by sending malicious input via SMI in order to bypass secu… |
CVE-2022-1974 | Medium | 4.1 | 2022-08-31 | A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition between kobject creation and delete. This vulnerability al… |
CVE-2021-35937 | Medium | 6.4 | 2022-08-25 | A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-201… |
CVE-2022-20909 | Medium | 6.0 | 2022-07-22 | Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabiliti… |
CVE-2022-20908 | Medium | 6.0 | 2022-07-22 | Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabiliti… |
CVE-2022-20907 | Medium | 6.0 | 2022-07-22 | Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabiliti… |
CVE-2022-20906 | Medium | 6.0 | 2022-07-22 | Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabiliti… |
CVE-2022-34899 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obta… |
CVE-2021-34986 | High | 7.8 | 2022-07-15 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.5.0 (49183). An attacker must first obtain t… |
CVE-2022-33691 | Medium | 6.2 | 2022-07-12 | A possible race condition vulnerability in score driver prior to SMR Jul-2022 Release 1 can allow local attackers to interleave malicious operations. |
CVE-2022-27904 | High | 7.0 | 2022-07-01 | Automox Agent for macOS before version 39 was vulnerable to a time-of-check/time-of-use (TOCTOU) race-condition attack during the agent install process. |
CVE-2021-35111 | High | 7.5 | 2022-06-14 | Improper validation of tag id while RRC sending tag id to MAC can lead to TOCTOU race condition in Snapdragon Connectivity, Snapdragon Mobile |
CVE-2021-35090 | Critical | 9.3 | 2022-06-14 | Possible hypervisor memory corruption due to TOC TOU race condition when updating address mappings in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectiv… |
CVE-2021-35082 | Critical | 9.1 | 2022-06-14 | Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC security mode command packet has been received in Snapd… |
CVE-2021-30347 | Critical | 9.1 | 2022-06-14 | Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC Command packet has been received in Snapdragon Auto, Sn… |
CVE-2021-30343 | Critical | 9.1 | 2022-06-14 | Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, Snapdrag… |
CVE-2021-30342 | Critical | 9.1 | 2022-06-14 | Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, Snapdrag… |