Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-50369HIGHWindows Remote Desktop Services Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2026-56649MEDIUMWindows Network File System Remote Code Execution VulnerabilityEPSS 0.7%CVE-2022-3566LOWLinux Kernel TCP tcp_setsockopt race conditionEPSS 0.7%CVE-2018-3759—private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the sockEPSS 0.7%CVE-2023-0739HIGHConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in answerdev/answerEPSS 0.7%CVE-2020-1667HIGHJunos OS: MX Series: Services card might restart due to a race condition when DNS filtering is enabled.EPSS 0.7%CVE-2024-27823MEDIUMA race condition was addressed with improved locking. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS MEPSS 0.7%CVE-2021-21005HIGHRace Condition Vulnerability in Phoenix Contact FL SWITCH SMCS series productsEPSS 0.7%CVE-2022-3307HIGHUse after free in media in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially exploit heap corruption via a craftEPSS 0.7%CVE-2022-2160MEDIUMInsufficient policy enforcement in DevTools in Google Chrome on Windows prior to 103.0.5060.53 allowed an attacker who convinced a user to iEPSS 0.7%CVE-2025-50169HIGHWindows SMB Remote Code Execution VulnerabilityEPSS 0.7%CVE-2021-31364MEDIUMJunos OS: SRX Series: The flowd process will crash if log session-close is configured and specific traffic is receivedEPSS 0.7%CVE-2022-3049HIGHUse after free in SplitScreen in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user toEPSS 0.7%CVE-2026-70091MEDIUMWindows DNS Denial of Service VulnerabilityEPSS 0.7%CVE-2016-20015HIGHIn the ebuild package through smokeping-2.7.3-r1 for SmokePing on Gentoo, the initscript allows the smokeping user to gain ownership of any EPSS 0.6%CVE-2021-0258MEDIUMJunos OS: Kernel panic upon receipt of specific TCPv6 packet on management interfaceEPSS 0.6%CVE-2024-36623HIGHmoby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent writEPSS 0.6%CVE-2022-4037MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versioEPSS 0.6%CVE-2020-1645HIGHJunos OS: MX Series: Services card might restart when DNS filtering is enabledEPSS 0.6%CVE-2024-36621MEDIUMmoby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger EPSS 0.6%