Weaknesses of type CWE-362

1,433 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2018-10850MEDIUM389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting EPSS 1.5%CVE-2022-31015MEDIUMUncaught Exception (due to a data race) leads to process termination in WaitressEPSS 1.5%CVE-2022-24800HIGHRace Condition in October CMS upload processEPSS 1.5%CVE-2018-17244—Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active DirEPSS 1.5%CVE-2015-8963HIGHRace condition in kernel/events/core.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (usEPSS 1.4%CVE-2024-49124HIGHLightweight Directory Access Protocol (LDAP) Client Remote Code Execution VulnerabilityEPSS 1.4%CVE-2022-41039HIGHWindows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityEPSS 1.4%CVE-2026-5947HIGHSIG(0) validation during query flood may lead to undefined behaviorEPSS 1.4%CVE-2022-24950—A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other users' SSH authorizEPSS 1.3%CVE-2022-34702HIGHWindows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityEPSS 1.3%CVE-2022-39328CRITICALGrafana vulnerable to race condition allowing privilege escalationEPSS 1.3%CVE-2022-27626CRITICALA vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the sessioEPSS 1.3%CVE-2024-2193MEDIUMSpeculative Race Condition impacts modern CPU architectures that support speculative execution, also known as GhostRace.EPSS 1.3%CVE-2022-23639HIGHImproper Restriction of Operations within the Bounds of a Memory Buffer and Race Condition in crossbeam-utilsEPSS 1.2%CVE-2025-25214HIGHA race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. EPSS 1.2%CVE-2026-27921HIGHWindows TDI Translation Driver (tdx.sys) Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2021-24377—Autoptimize < 2.7.8 - Race Condition leading to RCEEPSS 1.2%CVE-2026-20921HIGHWindows SMB Server Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2023-28201CRITICALThis issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iEPSS 1.2%CVE-2023-27359CRITICALTP-Link AX1800 hotplugd Firewall Rule Race Condition VulnerabilityEPSS 1.2%