Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-21237HIGHWindows Subsystem for Linux Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-86744LOWsnipe-it before 8.7.0 Race Condition in Asset CheckoutEPSS 0.3%CVE-2025-53135HIGHDirectX Graphics Kernel Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-24040MEDIUMjsPDF has a Shared State Race Condition in addJS PluginEPSS 0.3%CVE-2022-50350CRITICALscsi: target: iscsi: Fix a race condition between login_work and the login threadEPSS 0.3%CVE-2025-8880HIGHRace in V8 in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML EPSS 0.3%CVE-2025-55328HIGHWindows Hyper-V Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-18250MEDIUMIBM i is Affected By Multiple Vulnerabilities in Navigator for iEPSS 0.3%CVE-2026-19975LOWAzuriom CMS Money Transfer ProfileController.php transferMoney toctouEPSS 0.3%CVE-2025-48751LOWThe process_lock crate 0.1.0 for Rust allows data races in unlock.EPSS 0.3%CVE-2026-16208LOWdjango-tastypie throttle.py CacheDBThrottle race conditionEPSS 0.3%CVE-2020-3350MEDIUMCisco AMP for Endpoints and ClamAV Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-40155MEDIUMAuth0 Next.js SDK has Improper Proxy Cache LookupEPSS 0.3%CVE-2025-55687HIGHWindows Resilient File System (ReFS) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-43728HIGHThis issue was addressed through improved state management. This issue is fixed in macOS Tahoe 26.6. An attacker may be able to modify the sEPSS 0.3%CVE-2025-55335HIGHWindows NTFS Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-59196HIGHWindows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2024-48872MEDIUMBypass of "Max failed attempts" restriction via race conditionEPSS 0.3%CVE-2026-32088MEDIUMWindows Biometric Service Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2026-28604HIGHIn multiple locations, there is a possible use after free due to a race condition. This could lead to remote code execution with no additionEPSS 0.3%