Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-9831MEDIUMExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race ConditionEPSS 0.3%CVE-2022-34892HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop 17.1.1. AnEPSS 0.3%CVE-2026-50458HIGHMicrosoft Brokering File System Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-47386MEDIUMNocoDB: OAuth Authorization Code Race ConditionEPSS 0.3%CVE-2026-50677HIGHWindows Media Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-26181HIGHMicrosoft Brokering File System Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-50385HIGHWindows Runtime Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-50689HIGHWindows Clipboard Server Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-50361HIGHMicrosoft Brokering File System Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-61349HIGHWindows Work Folder Service Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-50305HIGHMicrosoft Brokering File System Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-50139MEDIUMgoshs: Share-link ?token=… redemption races past download limitEPSS 0.3%CVE-2026-50457HIGHWindows Runtime Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-54125HIGHWindows Runtime Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-32089HIGHWindows Speech Brokered Api Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-32153HIGHWindows Speech Runtime Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-50427HIGHContent Delivery Manager Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-14015MEDIUMRace in WebRTC in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML pagEPSS 0.3%CVE-2026-14082MEDIUMRace in Storage in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (ChromiEPSS 0.3%CVE-2022-45869MEDIUMA race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial of service (host OS crEPSS 0.3%