Weaknesses of type CWE-362

1,433 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-103112HIGHKeycloak-services: keycloak-services: account takeover via authentication race using reset-credentials pathEPSS 0.4%CVE-2025-21947HIGHksmbd: fix type confusion via race condition when using ipc_msg_send_requestEPSS 0.4%CVE-2026-82942HIGHApache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of ServiceEPSS 0.4%CVE-2025-54919HIGHWindows Graphics Component Remote Code Execution VulnerabilityEPSS 0.4%CVE-2022-44563MEDIUMThere is a race condition vulnerability in SD upgrade mode. Successful exploitation of this vulnerability may affect data confidentiality.EPSS 0.4%CVE-2025-26649HIGHWindows Secure Channel Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-53049CRITICALgfs2: add some missing log lockingEPSS 0.4%CVE-2024-0605HIGHUsing a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bEPSS 0.4%CVE-2024-20509MEDIUMA vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unEPSS 0.4%CVE-2026-51082HIGHA race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-manager before 9.1.9 and 8.x bEPSS 0.4%CVE-2026-24297MEDIUMWindows Kerberos Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2024-12747MEDIUMRsync: race condition in rsync handling symbolic linksEPSS 0.4%CVE-2022-3328HIGHRace condition in snap-confine's must_mkdir_and_open_with_perms()EPSS 0.4%CVE-2026-57030HIGHJunos OS: SRX Series: Flow sessions are not getting cleared leading to a DoSEPSS 0.4%CVE-2025-50167HIGHWindows Hyper-V Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-64779LOWA memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10,EPSS 0.4%CVE-2023-30543MEDIUM`chainId` may be outdated if user changes chains as part of connection in @web3-reactEPSS 0.4%CVE-2026-26456HIGHA null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccdEPSS 0.4%CVE-2025-1493MEDIUMIBM Db2 denial of serviceEPSS 0.4%CVE-2026-91947HIGHFreeRDP Server before 3.31.0 Use-After-Free via DRDYNVCEPSS 0.4%