Weaknesses of type CWE-362

1,433 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2021-0258MEDIUMJunos OS: Kernel panic upon receipt of specific TCPv6 packet on management interfaceEPSS 0.6%CVE-2024-36623HIGHmoby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent writEPSS 0.6%CVE-2022-46174MEDIUMRace condition during concurrent TLS mounts in efs-utilsEPSS 0.6%CVE-2025-43275CRITICALA race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.EPSS 0.6%CVE-2020-1645HIGHJunos OS: MX Series: Services card might restart when DNS filtering is enabledEPSS 0.6%CVE-2024-53476MEDIUMA race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory restEPSS 0.6%CVE-2024-36621MEDIUMmoby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger EPSS 0.6%CVE-2022-22746MEDIUMA race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticedEPSS 0.6%CVE-2022-3042HIGHUse after free in PhoneHub in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corrupEPSS 0.6%CVE-2019-3016MEDIUMIn a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in theEPSS 0.6%CVE-2023-22499HIGHInteractive permission prompt spoofing in DenoEPSS 0.6%CVE-2026-56188CRITICALWindows Server Network driver Remote Code Execution VulnerabilityEPSS 0.6%CVE-2025-59282HIGHInternet Information Services (IIS) Inbox COM Objects (Global Memory) Remote Code Execution VulnerabilityEPSS 0.6%CVE-2021-31382MEDIUMJunos OS: PTX1000 System, PTX10002-60C System: After upgrading, configured firewall filters may be applied on incorrect interfacesEPSS 0.6%CVE-2025-43244CRITICALA race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 1EPSS 0.6%CVE-2022-22763HIGHWhen a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. TEPSS 0.6%CVE-2025-21278MEDIUMWindows Remote Desktop Gateway (RD Gateway) Denial of Service VulnerabilityEPSS 0.6%CVE-2026-43631CRITICALllama.cpp b7492–b9060 Use-After-Free RCE via llama-serverEPSS 0.6%CVE-2026-94043MEDIUMFree5GC Gmm handler.go race conditionEPSS 0.6%CVE-2026-58608HIGHWindows Print Spooler Remote Code Execution VulnerabilityEPSS 0.6%