Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2025-54919HIGHWindows Graphics Component Remote Code Execution VulnerabilityEPSS 0.4%CVE-2020-1641MEDIUMJunos OS: A race condition on receipt of crafted LLDP packets leads to a memory leak and an LLDP crash.EPSS 0.4%CVE-2026-17711CRITICALRace in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potenEPSS 0.4%CVE-2026-78934HIGHRace condition in ReadAloud in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitEPSS 0.4%CVE-2026-57030HIGHJunos OS: SRX Series: Flow sessions are not getting cleared leading to a DoSEPSS 0.4%CVE-2025-26649HIGHWindows Secure Channel Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2023-30543MEDIUM`chainId` may be outdated if user changes chains as part of connection in @web3-reactEPSS 0.4%CVE-2025-21947HIGHksmbd: fix type confusion via race condition when using ipc_msg_send_requestEPSS 0.4%CVE-2023-6109MEDIUMYOP Poll <= 6.5.26 - Race Condition to Vote ManipulationEPSS 0.4%CVE-2021-3573—A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR orEPSS 0.4%CVE-2021-3640—A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER EPSS 0.4%CVE-2024-47870HIGHRace condition in update_root_in_config may redirect user traffic in GradioEPSS 0.4%CVE-2026-77633HIGHCloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of serviceEPSS 0.4%CVE-2026-63756CRITICALSurrealDB before 3.1.0 Privilege Escalation via RPC Session Race ConditionEPSS 0.4%CVE-2026-34363HIGHParse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribersEPSS 0.4%CVE-2021-25395MEDIUMA race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilEPSS 0.4%KEVCVE-2024-39554HIGHJunos OS and Junos OS Evolved: BGP multipath incremental calculation is resulting in an rpd crashEPSS 0.4%CVE-2010-5160MEDIUMRace condition in ESET Smart Security 4.2.35.3 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous cEPSS 0.4%CVE-2021-4202—A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in the Linux kernel. This flaw could EPSS 0.4%CVE-2026-41458HIGHOwnTone Server < 29.1 Race Condition DoS via DAAP LoginEPSS 0.4%