Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2019-3016MEDIUMIn a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in theEPSS 0.6%CVE-2022-3042HIGHUse after free in PhoneHub in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corrupEPSS 0.6%CVE-2024-53476MEDIUMA race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory restEPSS 0.6%CVE-2025-59282HIGHInternet Information Services (IIS) Inbox COM Objects (Global Memory) Remote Code Execution VulnerabilityEPSS 0.6%CVE-2025-43275CRITICALA race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.EPSS 0.6%CVE-2026-56188CRITICALWindows Server Network driver Remote Code Execution VulnerabilityEPSS 0.6%CVE-2021-31382MEDIUMJunos OS: PTX1000 System, PTX10002-60C System: After upgrading, configured firewall filters may be applied on incorrect interfacesEPSS 0.6%CVE-2023-22499HIGHInteractive permission prompt spoofing in DenoEPSS 0.6%CVE-2026-45742HIGHGotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')EPSS 0.6%CVE-2022-22746MEDIUMA race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticedEPSS 0.6%CVE-2022-46174MEDIUMRace condition during concurrent TLS mounts in efs-utilsEPSS 0.6%CVE-2025-43244CRITICALA race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 1EPSS 0.6%CVE-2025-10263CRITICALArm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-EPSS 0.6%CVE-2025-21278MEDIUMWindows Remote Desktop Gateway (RD Gateway) Denial of Service VulnerabilityEPSS 0.6%CVE-2026-50414HIGHWindows Media Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2026-58608HIGHWindows Print Spooler Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-50398HIGHWindows Media Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2026-23735HIGHConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in graphql-modulesEPSS 0.6%CVE-2023-1672MEDIUMRace condition exists in the key generation and rotation functionalityEPSS 0.6%CVE-2022-22763HIGHWhen a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. TEPSS 0.6%