CVE-2024-9183

Summary: CVE-2024-9183 affects GitLab CE/EE versions 18.4 (before 18.4.5), 18.5 (before 18.5.3), and 18.6 (before 18.6.1). A TOCTOU race condition could allow an authenticated user to obtain credentials from higher-privileged users and act in their context under specific conditions. The issue is ...

CVE-2025-62724

Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, users can craft a "Time of Check to Time of Use" TOCTOU attack when downloading zip files to access files outside of the OODALLOWLIST. This vulnerability impacts sites that use the file browser allowlists in all curre...

CVE-2025-62724

Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, users can craft a "Time of Check to Time of Use" TOCTOU attack when downloading zip files to access files outside of the OODALLOWLIST. This vulnerability impacts sites that use the file browser allowlists in all curre...

CVE-2025-62724

CVE-2025-62724 affects Open OnDemand (HPC portal). Prior to versions 4.0.8 and 3.1.16, a TOCTOU condition can be exploited during zip-file downloads to access files outside the OOD_ALLOWLIST. Impacted sites using file browser allowlists may be able to reach restricted files, though UNIX permissio...

Open OnDemand 安全漏洞

Open OnDemand is an open source implementation of Open Interactive HPC over the Web from Ohio Supercomputer Center. A security vulnerability exists in Open OnDemand versions prior to 4.0.8 and prior to 3.1.16, which stems from a TOCTOU attack that could lead to access to files other than...

curl: [SFTP] TOCTOU Race Condition in Upload Resume Logic Leads to Arbitrary File Append

Summary: A Time-of-check to Time-of-use TOCTOU race condition exists in the SFTP upload resume functionality of libcurl. When resuming an upload with CURLOPTRESUMEFROM set to -1 the equivalent of the curl -C - command-line flag, libcurl first performs a STAT operation to determine the remote file...

Siemens SCALANCE and RUGGEDCOM Devices Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-2024-50234)

wifi: iwlegacy: vulnerability due to stale interrupts not being cleared before resuming the iwl4965 device from hibernation, causing a race condition between the resume process and restart work. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for...

EUVD-2025-197847

Kernel or driver software installed on a Guest VM may post improper commands to the GPU Firmware to exploit a TOCTOU race condition and trigger a read and/or write of data outside the allotted memory escaping the virtual machine...

CVE-2025-31146

Time-of-check time-of-use race condition for some Intel Ethernet Adapter Complete Driver Pack software before version 1.5.1.0 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable...

EUVD-2025-93491

Time-of-check time-of-use race condition for some Intel Ethernet Adapter Complete Driver Pack software before version 1.5.1.0 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable...

CVE-2025-31146

Time-of-check time-of-use race condition for some Intel Ethernet Adapter Complete Driver Pack software before version 1.5.1.0 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable...

CVE-2025-27725

Time-of-check time-of-use race condition for some ACAT before version 3.13 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result may potentially...

CVE-2025-31146

The CVE-2025-31146 issue affects Intel Ethernet Adapter Complete Driver Pack before version 1.5.1.0. The Red Hat / ENISA entries describe a time-of-check time-of-use race condition in Ring 3 (User Applications) that can allow a denial of service, with an unprivileged authenticated user and low-co...

CVE-2025-31146

Time-of-check time-of-use race condition for some Intel Ethernet Adapter Complete Driver Pack software before version 1.5.1.0 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable...

CVE-2025-27725

CVE-2025-27725 describes a time-of-check time-of-use race condition in Intel ACAT (Assistive Context-Aware Toolkit) software before version 3.13, impacting Ring 3 user applications. The root cause is a race in the user-space component that can allow a local, authenticated, low-privilege attacker ...

CVE-2025-27725

Time-of-check time-of-use race condition for some ACAT before version 3.13 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result may potentially...

CVE-2025-64180

The vulnerability CVE-2025-64180 affects Manager-io/Manager Desktop and Server (versions 25.11.1.3085 and earlier). The issue stems from a TOCTOU race condition in the DNS validation mechanism, allowing an attacker to bypass network isolation and access internal resources, cloud metadata endpoint...

CVE-2025-64180 Manager-io/Manager: Complete Bypass of SSRF Protection via Time-of-Check Time-of-Use (TOCTOU)

Manager-io/Manager is accounting software. In Manager Desktop and Server versions 25.11.1.3085 and below, a critical vulnerability permits unauthorized access to internal network resources. The flaw lies in the fundamental design of the DNS validation mechanism. A Time-of-Check Time-of-Use TOCTOU...

EUVD-2025-38234

Manager-io/Manager is accounting software. In Manager Desktop and Server versions 25.11.1.3085 and below, a critical vulnerability permits unauthorized access to internal network resources. The flaw lies in the fundamental design of the DNS validation mechanism. A Time-of-Check Time-of-Use TOCTOU...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: hwmon: ftsteutates Fixed the TOCTOU race condition in ftsread In the ftsread function, when handling hwmonpwmautochannelstemp, the code accesses the shared variable data-fansourcechannel twice without holding any locks. This chec...