Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-61352HIGHRemote Desktop Client Remote Code Execution VulnerabilityEPSS 0.4%CVE-2024-6996LOWRace in Frames in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to pEPSS 0.4%CVE-2018-16867HIGHA flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0. A path traversal in the in usb_mtp_write_data function in hw/usEPSS 0.4%CVE-2026-53517HIGHBetter Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family ForkingEPSS 0.4%CVE-2026-43631CRITICALllama.cpp b7492–b9060 Use-After-Free RCE via llama-serverEPSS 0.4%CVE-2024-45300HIGHBypassing promo code limitations with race conditionsEPSS 0.4%CVE-2025-53132HIGHWin32k Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2020-28049MEDIUMAn issue was discovered in SDDM before 0.19.0. It incorrectly starts the X server in a way that - for a short time period - allows local unpEPSS 0.4%CVE-2022-40130MEDIUMWordPress WP-Polls plugin <= 2.76.0 - Auth. Race Condition vulnerabilityEPSS 0.4%CVE-2025-54115HIGHWindows Hyper-V Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2024-48069CRITICALA vulnerability was found in Weaver E-cology allows attackers use race conditions to bypass security mechanisms to upload malicious files anEPSS 0.4%CVE-2026-28986HIGHA race condition was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, maEPSS 0.4%CVE-2026-21697HIGHaxios4go's Race Condition in Shared HTTP Client Allows Proxy Configuration LeakEPSS 0.4%CVE-2022-24540HIGHWindows ALPC Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-59455MEDIUMIn JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race conditionEPSS 0.4%CVE-2026-54999HIGHWindows TCP/IP Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-43805CRITICALA race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS SoEPSS 0.4%CVE-2026-53518HIGHBetter Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code RedemptionEPSS 0.4%CVE-2025-15116MEDIUMOpenCart Single-Use Coupon race conditionEPSS 0.4%CVE-2020-29372MEDIUMAn issue was discovered in do_madvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operationEPSS 0.4%