Fallos del tipo CWE-362

1089 resultados

Condição de corrida (Race Condition)

Ocorre quando múltiplas threads ou processos acessam e modificam um recurso compartilhado (arquivo, variável, banco de dados) sem sincronização adequada. O resultado final depende da ordem de execução, que é imprevisível, permitindo que um atacante manipule o timing para causar comportamento não autorizado ou corrupção de dados.

Ejemplo

Um aplicativo web verifica se um usuário tem saldo antes de debitar uma transação, mas não mantém lock entre a verificação e o débito. Um atacante dispara dois saques simultâneos da mesma conta; ambos passam na validação antes que qualquer um tenha atualizado o saldo, resultando em saque maior que o disponível.

Cómo mitigar

Use mecanismos de sincronização (mutex, semáforos, locks) ao acessar recursos compartilhados, ou implemente operações atômicas que garantam que verificação e modificação ocorram como uma única unidade indivisível. Em bases de dados, use transações com isolamento adequado (SERIALIZABLE quando necessário).

CVE-2026-20815HIGHCapability Access Management Service (camsvc) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-20861HIGHWindows Management Services Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-1220HIGHRace in V8 in Google Chrome prior to 144.0.7559.99 allowed a remote attacker to potentially exploit type confusion via a crafted HTML page. EPSS 0.3%CVE-2024-51505HIGHAn issue was discovered in Atos Eviden IDRA before 2.7.1. A highly trusted role (Config Admin) could leverage a race condition to escalate pEPSS 0.3%CVE-2026-20874HIGHWindows Management Services Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-20869HIGHWindows Local Session Manager (LSM) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-48505HIGHFilament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submissionEPSS 0.3%CVE-2026-79014MEDIUMRace condition in Autofill in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypEPSS 0.3%CVE-2025-23259MEDIUMNVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver (PMD), where an attacker on a VM in the system might be able to cause infoEPSS 0.3%CVE-2026-87816HIGHPasswordPusher before 2.11.1 Race Condition View Limit BypassEPSS 0.3%CVE-2026-44693HIGHPi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session BufferEPSS 0.3%CVE-2020-10737MEDIUMA race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the hoEPSS 0.3%CVE-2025-54913HIGHWindows UI XAML Maps MapControlSettings Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-55223HIGHDirectX Graphics Kernel Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2022-45887MEDIUMAn issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of EPSS 0.3%CVE-2025-13036CRITICALRockwell Automation FactoryTalk Historian Site Edition - Authentication BypassEPSS 0.3%CVE-2026-34342HIGHWindows Print Spooler Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-16212LOWawesto django-shop Purchase Stock inventory.py race conditionEPSS 0.3%CVE-2023-28144HIGHKDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involvingEPSS 0.3%CVE-2025-48000HIGHWindows Connected Devices Platform Service Elevation of Privilege VulnerabilityEPSS 0.3%