Weaknesses of type CWE-362

1,433 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-50414HIGHWindows Media Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2026-58608HIGHWindows Print Spooler Remote Code Execution VulnerabilityEPSS 0.6%CVE-2023-1672MEDIUMRace condition exists in the key generation and rotation functionalityEPSS 0.6%CVE-2026-23240CRITICALtls: Fix race condition in tls_sw_cancel_work_tx()EPSS 0.6%CVE-2026-23735HIGHConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in graphql-modulesEPSS 0.6%CVE-2022-3071HIGHUse after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to eEPSS 0.6%CVE-2026-28982CRITICALA race condition was addressed with improved locking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A EPSS 0.6%CVE-2021-0247MEDIUMJunos OS: PTX Series, QFX Series: Due to a race condition input loopback firewall filters applied to interfaces may not operate even when listed in the running configuration.EPSS 0.6%CVE-2026-33028HIGHNginx UI: Race Condition Leads to Persistent Data Corruption and Service CollapseEPSS 0.6%CVE-2024-27102CRITICALImproper isolation of server file access in github.com/pterodactyl/wingsEPSS 0.5%CVE-2025-10263CRITICALArm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-EPSS 0.5%CVE-2026-62820HIGHWindows DNS Server Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-50460HIGHWindows Runtime Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-62778HIGHWindows DNS Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-1127CRITICALCombination Path Traversal and Concurrent Execution vulnerability exists within the embedded web serverEPSS 0.5%CVE-2026-32226MEDIUM.NET Framework Denial of Service VulnerabilityEPSS 0.5%CVE-2026-66802HIGHWindows Device Health Attestation (DHA) Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-42900HIGHMicrosoft Windows App Store Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-69782HIGHWindows DNS Server Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-69827HIGHWindows DNS Server Remote Code Execution VulnerabilityEPSS 0.5%