Weaknesses of type CWE-362

1,090 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2025-13231MEDIUMFancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Server-Side Request Forgery via Race ConditionEPSS 0.2%CVE-2026-59321MEDIUMShared JSR-223 ScriptEngine evaluated concurrently without THREADING checkEPSS 0.2%CVE-2025-24094MEDIUMA race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.EPSS 0.2%CVE-2026-17724MEDIUMRace in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) vEPSS 0.2%CVE-2021-0298MEDIUMJunos OS Evolved: PTX10003, PTX10008: picd core while executing the "show chassis pic" command under certain conditionsEPSS 0.2%CVE-2026-10654LOWRFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth ClassicEPSS 0.2%CVE-2026-34850LOWRace condition vulnerability in the notification service. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.2%CVE-2025-71066HIGHnet/sched: ets: Always remove class from active list before deleting in ets_qdisc_changeEPSS 0.2%CVE-2025-43292MEDIUMA race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7, macOS Sequoia 15.7.2, macOS Tahoe 26EPSS 0.2%CVE-2025-21701HIGHnet: avoid race between device unregistration and ethnl opsEPSS 0.2%CVE-2024-53100HIGHnvme: tcp: avoid race between queue_lock lock and destroyEPSS 0.2%CVE-2024-23275MEDIUMA race condition was addressed with additional validation. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13EPSS 0.2%CVE-2024-23196MEDIUMRace condition vulnerability in Linux kernel sound/hda snd_hdac_regmap_syncEPSS 0.2%CVE-2025-52517MEDIUMAn issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. A race cEPSS 0.2%CVE-2026-91723MEDIUMRace condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML pEPSS 0.2%CVE-2026-15995MEDIUMIBM Cognos Analytics 12.1.3 general availability package contains a data integrity issue in the Agentic AI assistant that may cause incorrect report summaries or report-processing errors under concurrent useEPSS 0.2%CVE-2025-21943MEDIUMgpio: aggregator: protect driver attr handlers against module unloadEPSS 0.2%CVE-2026-1199MEDIUMAPI and Frontend login lockout race conditionEPSS 0.2%CVE-2026-12022HIGHRace in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to EPSS 0.2%CVE-2024-50135MEDIUMnvme-pci: fix race condition between reset and nvme_dev_disable()EPSS 0.2%