Weaknesses of type CWE-362

1,433 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2025-66446HIGHMaxKB has a Python sandbox LD_PRELOAD bypassEPSS 0.3%CVE-2024-49353HIGHIBM Watson Speech Services Cartridge for IBM Cloud Pak for Data denial of serviceEPSS 0.3%CVE-2026-42594HIGHGotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutineEPSS 0.3%CVE-2026-86766HIGHSnipe-IT 8.6.3 Race Condition via Consumable CheckoutEPSS 0.3%CVE-2026-7208MEDIUMYealink SIP-T33G < 124.87.0.0 Race Condition via Diagnostic File DeletionEPSS 0.3%CVE-2026-85639MEDIUMjofpin trape Telemetry Endpoint user.py race conditionEPSS 0.3%CVE-2022-26807HIGHWindows Work Folder Service Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-32991CRITICALIn N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution.EPSS 0.3%CVE-2017-18018HIGHIn GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of theEPSS 0.3%CVE-2026-117507MEDIUMa2aproject a2a-java TaskManager.saveTaskEvent race conditionEPSS 0.3%CVE-2025-54092HIGHWindows Hyper-V Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-47735LOWinner::drop in inner.rs in the wgp crate through 0.2.0 for Rust lacks drop_slow thread synchronization.EPSS 0.3%CVE-2024-32477HIGHRace condition when flushing input stream leads to permission prompt bypassEPSS 0.3%CVE-2025-45731MEDIUMA group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned accounts when a group is deleted while other operaEPSS 0.3%CVE-2026-63980HIGHnet/handshake: Use spin_lock_bh for hn_lockEPSS 0.3%CVE-2022-1462—An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition usinEPSS 0.3%CVE-2026-44102MEDIUMOCPP Firmware download is not properly lockedEPSS 0.3%CVE-2026-46316CRITICALKVM: arm64: vgic-its: Drop the translation cache reference only for the erased entryEPSS 0.3%CVE-2026-106500HIGHBackstage: Improper task state validation in Scaffolder backendEPSS 0.3%CVE-2026-112459HIGHA race condition was addressed with improved state handling. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 2EPSS 0.3%