Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2024-26779HIGHwifi: mac80211: fix race condition on enabling fast-xmitEPSS 0.3%CVE-2025-40569MEDIUMA vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XCH328 (6GK5328-4TS01-2EC2) (All vEPSS 0.3%CVE-2026-32398MEDIUMWordPress TeraWallet – For WooCommerce plugin <= 1.5.15 - Race Condition vulnerabilityEPSS 0.3%CVE-2026-74984MEDIUMRace condition in the JavaScript Engine componentEPSS 0.3%CVE-2026-59324HIGHfluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunctionEPSS 0.3%CVE-2025-0439MEDIUMRace in Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to pEPSS 0.3%CVE-2025-66803MEDIUMRace condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame responsEPSS 0.3%CVE-2026-18150MEDIUMIBM i is Affected By Multiple Vulnerabilities in Navigator for iEPSS 0.3%CVE-2024-50297HIGHnet: xilinx: axienet: Enqueue Tx packets in dql before dmaengine startsEPSS 0.3%CVE-2026-17711CRITICALRace in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potenEPSS 0.3%CVE-2026-17709CRITICALRace in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potenEPSS 0.3%CVE-2026-17855CRITICALRace in DevTools in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentEPSS 0.3%CVE-2024-50313MEDIUMA vulnerability has been identified in Mendix Runtime V10 (All versions < V10.16.0 only if the basic authentication mechanism is used by theEPSS 0.3%CVE-2023-42756MEDIUMKernel: netfilter: race condition between ipset_cmd_add and ipset_cmd_swapEPSS 0.3%CVE-2023-37904LOWDiscourse Race Condition in Accept InviteEPSS 0.3%CVE-2025-49762HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2022-1247—An issue found in linux-kernel that leads to a race condition in rose_connect(). The rose driver uses rose_neigh->use to represent how many EPSS 0.3%CVE-2024-9936MEDIUMWhen manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitabEPSS 0.3%CVE-2026-32887HIGHEffect Bug: `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPCEPSS 0.3%CVE-2026-21234HIGHWindows Connected Devices Platform Service Elevation of Privilege VulnerabilityEPSS 0.3%