Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-20830HIGHCapability Access Management Service (camsvc) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-20869HIGHWindows Local Session Manager (LSM) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-48505HIGHFilament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submissionEPSS 0.3%CVE-2026-4368HIGHRace Condition leading to User Session MixupEPSS 0.3%CVE-2026-31827HIGHAlienbin: TTL Index Race Condition allows unauthorized deletion of other users dataEPSS 0.3%CVE-2026-58616MEDIUMCopilot Chat (Microsoft Edge) Information Disclosure VulnerabilityEPSS 0.3%CVE-2025-23259MEDIUMNVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver (PMD), where an attacker on a VM in the system might be able to cause infoEPSS 0.3%CVE-2026-64865MEDIUMNew API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypassEPSS 0.3%CVE-2020-10737MEDIUMA race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the hoEPSS 0.3%CVE-2025-54913HIGHWindows UI XAML Maps MapControlSettings Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-33009HIGHEVerest: MQTT Switch-Phases Command Data Race Causing Charger State CorruptioEPSS 0.3%CVE-2022-45887MEDIUMAn issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of EPSS 0.3%CVE-2025-55223HIGHDirectX Graphics Kernel Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-55318HIGHIn multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additionEPSS 0.3%CVE-2026-16212LOWawesto django-shop Purchase Stock inventory.py race conditionEPSS 0.3%CVE-2025-13036CRITICALRockwell Automation FactoryTalk Historian Site Edition - Authentication BypassEPSS 0.3%CVE-2026-82364LOWmacrozheng mall Order Submission submit race conditionEPSS 0.3%CVE-2026-17979HIGHRace in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pEPSS 0.3%CVE-2026-78901HIGHRace condition in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.3%CVE-2026-87601HIGHRace condition in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.3%