Weaknesses of type CWE-362

1,433 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-45712MEDIUMMailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)EPSS 0.3%CVE-2022-34696HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 0.3%CVE-2024-24255MEDIUMA Race Condition discovered in geofence.cpp and mission_feasibility_checker.cpp in PX4 Autopilot 1.14 and earlier allows attackers to send dEPSS 0.3%CVE-2022-45885HIGHAn issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_frontend.c has a race condition that can cause a use-aEPSS 0.3%CVE-2026-5120HIGHRace Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026EPSS 0.3%CVE-2026-113052HIGHRace condition in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandEPSS 0.3%CVE-2026-44318MEDIUMfree5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on SubscriptionsEPSS 0.3%CVE-2026-26201HIGHemp3r0r Affected by Concurrent Map Access DoS (panic/crash)EPSS 0.3%CVE-2026-64435HIGHaudit: Fix data races of skb_queue_len() readers on audit_queueEPSS 0.3%CVE-2020-10684HIGHA flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_faEPSS 0.3%CVE-2026-22856MEDIUMFreeRDP has a heap-use-after-free in create_irp_threadEPSS 0.3%CVE-2026-54497MEDIUMview_component: Reused Component Instances Retain Stale Render ContextEPSS 0.3%CVE-2025-33254HIGHNVIDIA Triton Inference Server contains a vulnerability where an attacker may cause internal state corruption. A successful exploit of this EPSS 0.3%CVE-2026-31539HIGHsmb: smbdirect: introduce smbdirect_socket.recv_io.credits.availableEPSS 0.3%CVE-2025-33238HIGHNVIDIA Triton Inference Server Sagemaker HTTP server contains a vulnerability where an attacker may cause an exception. A successful exploitEPSS 0.3%CVE-2025-48000HIGHWindows Connected Devices Platform Service Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-3608MEDIUMRace condition in nsHttpTransaction could lead to memory corruptionEPSS 0.3%CVE-2025-1801HIGHAap-gateway: aap-gateway privilege escalationEPSS 0.3%CVE-2025-55228HIGHWindows Graphics Component Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-1013MEDIUMPotential opening of private browsing tabs in normal browsing windowsEPSS 0.3%