Fallos del tipo CWE-362

1086 resultados

Condição de corrida (Race Condition)

Ocorre quando múltiplas threads ou processos acessam e modificam um recurso compartilhado (arquivo, variável, banco de dados) sem sincronização adequada. O resultado final depende da ordem de execução, que é imprevisível, permitindo que um atacante manipule o timing para causar comportamento não autorizado ou corrupção de dados.

Ejemplo

Um aplicativo web verifica se um usuário tem saldo antes de debitar uma transação, mas não mantém lock entre a verificação e o débito. Um atacante dispara dois saques simultâneos da mesma conta; ambos passam na validação antes que qualquer um tenha atualizado o saldo, resultando em saque maior que o disponível.

Cómo mitigar

Use mecanismos de sincronização (mutex, semáforos, locks) ao acessar recursos compartilhados, ou implemente operações atômicas que garantam que verificação e modificação ocorram como uma única unidade indivisível. Em bases de dados, use transações com isolamento adequado (SERIALIZABLE quando necessário).

CVE-2025-1493MEDIUMIBM Db2 denial of serviceEPSS 0.3%CVE-2024-11144CRITICALRace Condition with LightFTPEPSS 0.3%CVE-2025-50167HIGHWindows Hyper-V Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2020-10684HIGHA flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_faEPSS 0.3%CVE-2026-24297MEDIUMWindows Kerberos Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2023-33203MEDIUMThe Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/emac.c if a physicallyEPSS 0.3%CVE-2025-27492HIGHWindows Secure Channel Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2022-26807HIGHWindows Work Folder Service Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2017-18018HIGHIn GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of theEPSS 0.3%CVE-2025-54955HIGHOpenNebula Community Edition (CE) before 7.0.0 and Enterprise Edition (EE) before 6.10.3 have a critical FireEdge race condition that can leEPSS 0.3%CVE-2026-94043MEDIUMFree5GC Gmm handler.go race conditionEPSS 0.3%CVE-2026-25674LOWPotential incorrect permissions on newly created file system objectsEPSS 0.3%CVE-2024-32477HIGHRace condition when flushing input stream leads to permission prompt bypassEPSS 0.3%CVE-2025-59052HIGHAngular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data LeakageEPSS 0.3%CVE-2025-32991CRITICALIn N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution.EPSS 0.3%CVE-2022-44563MEDIUMThere is a race condition vulnerability in SD upgrade mode. Successful exploitation of this vulnerability may affect data confidentiality.EPSS 0.3%CVE-2026-33544HIGHTinyauth has OAuth account confusion via shared mutable state on singleton service instancesEPSS 0.3%CVE-2022-1462—An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition usinEPSS 0.3%CVE-2025-54092HIGHWindows Hyper-V Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2022-34696HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 0.3%