Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2023-2006HIGHA race condition was found in the Linux kernel's RxRPC network protocol, within the processing of RxRPC bundles. This issue results from theEPSS 0.4%CVE-2023-36405HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-56297HIGHFreeRDP - Use-After-Free via Race Condition in DRDYNVC Channel CallbackEPSS 0.4%CVE-2024-47827MEDIUMArgo Workflows Controller: Denial of Service via malicious daemon WorkflowsEPSS 0.4%CVE-2026-50348HIGHWindows Runtime Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-50452HIGHWindows Runtime Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-66802HIGHWindows Device Health Attestation (DHA) Remote Code Execution VulnerabilityEPSS 0.4%CVE-2024-24254MEDIUMPX4 Autopilot 1.14 and earlier, due to the lack of synchronization mechanism for loading geofence data, has a Race Condition vulnerability iEPSS 0.4%CVE-2023-41306—Vulnerability of mutex management in the bone voice ID trusted application (TA) module. Successful exploitation of this vulnerability may caEPSS 0.4%CVE-2026-53715MEDIUMEnvoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lockEPSS 0.4%CVE-2025-69871HIGHA race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage() function of the promotion module. The fuEPSS 0.4%CVE-2026-61628HIGHnginx ignition has Unauthenticated Admin Account Creation via Onboarding Race ConditionEPSS 0.4%CVE-2017-15129—A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_idEPSS 0.4%CVE-2026-45675HIGHOpen WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin AccountsEPSS 0.4%CVE-2025-58145HIGHArm issues with page refcountingEPSS 0.4%CVE-2026-4684HIGHRace condition, use-after-free in the Graphics: WebRender componentEPSS 0.4%CVE-2024-58248LOWnopCommerce through 4.90.1 does not offer locking for order placement. Thus there is a race condition with duplicate redeeming of gift cardsEPSS 0.4%CVE-2025-66446HIGHMaxKB has a Python sandbox LD_PRELOAD bypassEPSS 0.3%CVE-2024-49353HIGHIBM Watson Speech Services Cartridge for IBM Cloud Pak for Data denial of serviceEPSS 0.3%CVE-2026-42594HIGHGotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutineEPSS 0.3%