Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2021-0247MEDIUMJunos OS: PTX Series, QFX Series: Due to a race condition input loopback firewall filters applied to interfaces may not operate even when listed in the running configuration.EPSS 0.6%CVE-2022-3071HIGHUse after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to eEPSS 0.6%CVE-2024-27102CRITICALImproper isolation of server file access in github.com/pterodactyl/wingsEPSS 0.5%CVE-2025-47972HIGHWindows Input Method Editor (IME) Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-62820HIGHWindows DNS Server Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-69782HIGHWindows DNS Server Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-32226MEDIUM.NET Framework Denial of Service VulnerabilityEPSS 0.5%CVE-2026-50460HIGHWindows Runtime Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-1127CRITICALCombination Path Traversal and Concurrent Execution vulnerability exists within the embedded web serverEPSS 0.5%CVE-2026-42900HIGHMicrosoft Windows App Store Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-69827HIGHWindows DNS Server Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-33028HIGHNginx UI: Race Condition Leads to Persistent Data Corruption and Service CollapseEPSS 0.5%CVE-2023-35828HIGHAn issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesaEPSS 0.5%CVE-2025-15349HIGHAnritsu ShockLine SCPI Race Condition Remote Code Execution VulnerabilityEPSS 0.5%CVE-2023-24042HIGHA race condition in LightFTP through 2.2 allows an attacker to achieve path traversal via a malformed FTP request. A handler thread can use EPSS 0.5%CVE-2018-0480—Cisco IOS XE Software Errdisable Denial of Service VulnerabilityEPSS 0.5%CVE-2023-46132HIGHCrosslinking transaction attack in hyperledger/fabricEPSS 0.5%CVE-2023-47111HIGHZITADEL race condition in lockout policy executionEPSS 0.5%CVE-2024-38191HIGHKernel Streaming Service Driver Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-50379HIGHWindows Media Elevation of Privilege VulnerabilityEPSS 0.5%