Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2022-34696HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 0.3%CVE-2024-24255MEDIUMA Race Condition discovered in geofence.cpp and mission_feasibility_checker.cpp in PX4 Autopilot 1.14 and earlier allows attackers to send dEPSS 0.3%CVE-2026-5120HIGHRace Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026EPSS 0.3%CVE-2020-25653—A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unpriviEPSS 0.3%CVE-2024-11708MEDIUMMissing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. This vulnerability affecEPSS 0.3%CVE-2022-44032MEDIUMAn issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4000_cs.c has a race condition and resultant use-after-freeEPSS 0.3%CVE-2025-47545MEDIUMWordPress Poll Maker plugin <= 5.7.7 - Race Condition VulnerabilityEPSS 0.3%CVE-2025-47735LOWinner::drop in inner.rs in the wgp crate through 0.2.0 for Rust lacks drop_slow thread synchronization.EPSS 0.3%CVE-2026-20844HIGHWindows Clipboard Server Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-1013MEDIUMPotential opening of private browsing tabs in normal browsing windowsEPSS 0.3%CVE-2024-24858MEDIUMRace condition vulnerability in Linux kernel net/bluetooth in {conn,adv}_{min,max}_interval_set()EPSS 0.3%CVE-2025-33254HIGHNVIDIA Triton Inference Server contains a vulnerability where an attacker may cause internal state corruption. A successful exploit of this EPSS 0.3%CVE-2025-33238HIGHNVIDIA Triton Inference Server Sagemaker HTTP server contains a vulnerability where an attacker may cause an exception. A successful exploitEPSS 0.3%CVE-2026-22856MEDIUMFreeRDP has a heap-use-after-free in create_irp_threadEPSS 0.3%CVE-2025-1801HIGHAap-gateway: aap-gateway privilege escalationEPSS 0.3%CVE-2025-46336MEDIUMRack session gets restored after deletionEPSS 0.3%CVE-2025-55224HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-53768HIGHXbox IStorageService Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-55228HIGHWindows Graphics Component Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-53150HIGHWindows Digital Media Elevation of Privilege VulnerabilityEPSS 0.3%