CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition (page 8)
Page 8 of 8 — CVEs classified under CWE-367, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-19793 | High | 8.8 | 2019-12-13 | In Cyxtera AppGate SDP Client 4.1.x through 4.3.x before 4.3.2 on Windows, a local or remote user from the same domain can gain privileges. |
CVE-2019-10494 | High | 8.1 | 2019-12-12 | Race condition between the camera functions due to lack of resource lock which will lead to memory corruption and UAF issue in Snapdragon Auto, Snapdragon Cons… |
CVE-2013-4235 | Medium | 4.7 | 2019-12-03 | shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees |
CVE-2012-5630 | Medium | 6.3 | 2019-11-25 | libuser 0.56 and 0.57 has a TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees. |
CVE-2015-7810 | Medium | 4.7 | 2019-11-22 | libbluray MountManager class has a time-of-check time-of-use (TOCTOU) race when expanding JAR files |
CVE-2019-10486 | High | 7.0 | 2019-11-21 | Race condition due to the lack of resource lock which will be concurrently modified in the memcpy statement leads to out of bound access in Snapdragon Auto, Sn… |
CVE-2019-1380 | High | 7.8 | 2019-11-12 | A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'. |
CVE-2019-18644 | Medium | 5.9 | 2019-10-31 | The malware scan function in Total Defense Anti-virus 11.5.2.28 is vulnerable to a TOCTOU bug; consequently, symbolic link attacks allow privileged files to be… |
CVE-2019-11774 | High | 7.4 | 2019-09-12 | Prior to 0.1, all builds of Eclipse OMR contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for… |
CVE-2019-7307 | High | 7.0 | 2019-08-29 | Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability… |
CVE-2019-15316 | High | 7.0 | 2019-08-21 | Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of Crea… |
CVE-2019-11775 | High | 7.4 | 2019-07-30 | All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning -… |
CVE-2019-1065 | High | 7.8 | 2019-06-12 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this… |
CVE-2019-9486 | High | 8.8 | 2019-04-30 | STRATO HiDrive Desktop Client 5.0.1.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the HiDriveMaintenanceService service. This… |
CVE-2019-0836 | High | 7.8 | 2019-04-09 | An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulne… |
CVE-2019-5421 | Critical | 9.8 | 2019-04-03 | Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specif… |
CVE-2019-5519 | Medium | 6.8 | 2019-04-01 | VMware ESXi (6.7 before ESXi670-201903001, 6.5 before ESXi650-201903001, 6.0 before ESXi600-201903001), Workstation (15.x before 15.0.4, 14.x before 14.1.7), F… |
CVE-2019-7347 | High | 7.5 | 2019-02-04 | A Time-of-check Time-of-use (TOCTOU) Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for an authenticated user even after deleti… |
CVE-2019-7249 | Critical | 9.8 | 2019-01-31 | In Keybase before 2.12.6 on macOS, the move RPC to the Helper was susceptible to time-to-check-time-to-use bugs and would also allow one user of the system (wh… |
CVE-2017-15404 | High | 7.8 | 2019-01-09 | An ability to process crash dumps under root privileges and inappropriate symlinks handling could lead to a local privilege escalation in Crash Reporting in Go… |
CVE-2018-16872 | Medium | 5.3 | 2018-12-13 | A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_… |
CVE-2018-8584 | High | 7.8 | 2018-11-14 | An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Pr… |
CVE-2018-6693 | Medium | 5.3 | 2018-09-18 | An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of… |
CVE-2018-8449 | Low | 3.3 | 2018-09-13 | A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulnerability." This affe… |
CVE-2018-1121 | Low | 3.9 | 2018-06-13 | procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric orde… |
CVE-2018-0966 | Low | 3.3 | 2018-04-12 | A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulnerability." This affe… |
CVE-2017-11830 | Medium | 5.3 | 2017-11-15 | Device Guard in Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allows an attacker to make an unsigned file… |
CVE-2015-1865 | Medium | 5.1 | 2017-09-20 | fts.c in coreutils 8.4 allows local users to delete arbitrary files. |
CVE-2017-0756 | High | 7.8 | 2017-09-08 | A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1… |
CVE-2017-0331 | High | 7.8 | 2017-05-02 | An elevation of privilege vulnerability in the NVIDIA video driver could enable a local malicious application to execute arbitrary code within the context of t… |
CVE-2017-0412 | High | 7.8 | 2017-02-08 | An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a priv… |
CVE-2017-0411 | High | 7.8 | 2017-02-08 | An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a priv… |
CVE-2015-1743 | | 2015-06-10 | Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulne… | |
CVE-2013-3888 | High | 8.4 | 2013-10-09 | dxgkrnl.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privile… |
CVE-2005-1111 | Medium | 4.7 | 2005-05-02 | Race condition in cpio 2.6 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompres… |
CVE-2004-0594 | | 2004-07-27 | The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote… | |
CVE-2003-0813 | | 2003-11-17 | A multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch installed allows remote attackers to cause a denial of service (c… |