Weaknesses of type CWE-362

1,433 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-17712HIGHRace in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a craftEPSS 0.4%CVE-2025-38561CRITICALksmbd: fix Preauh_HashValue race conditionEPSS 0.4%CVE-2024-27267MEDIUMIBM SDK, Java Technology Edition denial of serviceEPSS 0.4%CVE-2023-47634LOWDecidim has race condition in EndorsementsEPSS 0.4%CVE-2024-29863HIGHA race condition in the installer executable in Qlik Qlikview before versions May 2022 SR3 (12.70.20300) and May 2023 SR2 (12,80.20200) may EPSS 0.4%CVE-2024-36615MEDIUMFFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exEPSS 0.4%CVE-2026-69364HIGHWindows Print Spooler Components Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2023-41306—Vulnerability of mutex management in the bone voice ID trusted application (TA) module. Successful exploitation of this vulnerability may caEPSS 0.4%CVE-2019-14898HIGHThe fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could use this flaw to obtain sensitive EPSS 0.4%CVE-2026-31598HIGHocfs2: fix possible deadlock between unlink and dio_end_io_writeEPSS 0.4%CVE-2024-49084HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-61628HIGHnginx ignition has Unauthenticated Admin Account Creation via Onboarding Race ConditionEPSS 0.4%CVE-2021-3609—.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to coEPSS 0.4%CVE-2024-23239MEDIUMA race condition was addressed with improved state handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, EPSS 0.4%CVE-2026-64782LOWA memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10,EPSS 0.4%CVE-2024-6996LOWRace in Frames in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to pEPSS 0.4%CVE-2022-40130MEDIUMWordPress WP-Polls plugin <= 2.76.0 - Auth. Race Condition vulnerabilityEPSS 0.4%CVE-2026-64160CRITICALnetfs: Fix potential for tearing in ->remote_i_size and ->zero_pointEPSS 0.4%CVE-2018-16867HIGHA flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0. A path traversal in the in usb_mtp_write_data function in hw/usEPSS 0.4%CVE-2026-85248MEDIUMApache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature InstanceEPSS 0.4%