Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-77063LOWmulter vulnerable to file size limit bypass via async fileFilter race conditionEPSS 0.2%CVE-2023-37244MEDIUMPrivilege escalation in N-Able's AutomationManagerAgentEPSS 0.2%CVE-2025-62300MEDIUMHCL IntelliOps Event Management is affected by multiple security vulnerabilities.EPSS 0.2%CVE-2025-12432HIGHRace in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.EPSS 0.2%CVE-2024-40849HIGHA race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to break out of itsEPSS 0.2%CVE-2022-3521LOWLinux Kernel kcm kcmsock.c kcm_tx_work race conditionEPSS 0.2%CVE-2025-15242LOWPHPEMS Coupon race conditionEPSS 0.2%CVE-2026-17822MEDIUMRace in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML paEPSS 0.2%CVE-2026-7846LOWchatchat-space Langchain-Chatchat OpenAI-Compatible File Upload API openai_routes.py files toctouEPSS 0.2%CVE-2026-5893MEDIUMRace in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.EPSS 0.2%CVE-2026-17841MEDIUMRace in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML paEPSS 0.2%CVE-2026-17999MEDIUMRace in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a craftEPSS 0.2%CVE-2025-49678HIGHNTFS Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-10006HIGHRace in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a craftedEPSS 0.2%CVE-2025-32441MEDIUMRack session gets restored after deletionEPSS 0.2%CVE-2020-27837—A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the EPSS 0.2%CVE-2026-10940HIGHRace in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to poteEPSS 0.2%CVE-2021-20261—A race condition was found in the Linux kernels implementation of the floppy disk drive controller driver software. The impact of this issueEPSS 0.2%CVE-2026-7960MEDIUMRace in Speech in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to obtain potentiaEPSS 0.2%CVE-2026-8520HIGHRace in Payments in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTEPSS 0.2%