Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-62690HIGHWindows Push Notifications Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-54996HIGHWindows USB Print Driver Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-50672HIGHWindows NTFS Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-69404HIGHWindows TCP/IP Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-45603HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-42978HIGHWindows Push Notifications Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2022-31645HIGHPotential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escEPSS 0.2%CVE-2024-35899HIGHnetfilter: nf_tables: flush pending destroy work before exit_net releaseEPSS 0.2%CVE-2023-35823HIGHAn issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134EPSS 0.2%CVE-2024-7017HIGHInappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandboxEPSS 0.2%CVE-2025-59205HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2022-32844MEDIUMA race condition was addressed with improved state handling. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6. An appEPSS 0.2%CVE-2024-50174HIGHdrm/panthor: Fix race when converting group handle to group objectEPSS 0.2%CVE-2025-68146MEDIUMfilelock has TOCTOU race condition that allows symlink attacks during lock file creationEPSS 0.2%CVE-2023-35824HIGHAn issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c.EPSS 0.2%CVE-2022-49599MEDIUMtcp: Fix data-races around sysctl_tcp_l3mdev_accept.EPSS 0.2%CVE-2024-54510MEDIUMA race condition was addressed with improved locking. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, maEPSS 0.2%CVE-2025-58727HIGHWindows Connected Devices Platform Service Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-9030MEDIUMAuthenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6EPSS 0.2%CVE-2026-22548HIGHBIG-IP Advanced WAF and ASM vulnerabilityEPSS 0.2%