Fallos del tipo CWE-362

1433 resultados

Condição de corrida (Race Condition)

Ocorre quando múltiplas threads ou processos acessam e modificam um recurso compartilhado (arquivo, variável, banco de dados) sem sincronização adequada. O resultado final depende da ordem de execução, que é imprevisível, permitindo que um atacante manipule o timing para causar comportamento não autorizado ou corrupção de dados.

Ejemplo

Um aplicativo web verifica se um usuário tem saldo antes de debitar uma transação, mas não mantém lock entre a verificação e o débito. Um atacante dispara dois saques simultâneos da mesma conta; ambos passam na validação antes que qualquer um tenha atualizado o saldo, resultando em saque maior que o disponível.

Cómo mitigar

Use mecanismos de sincronização (mutex, semáforos, locks) ao acessar recursos compartilhados, ou implemente operações atômicas que garantam que verificação e modificação ocorram como uma única unidade indivisível. Em bases de dados, use transações com isolamento adequado (SERIALIZABLE quando necessário).

CVE-2026-32700MEDIUMDevise has a confirmable "change email" race condition that permits user to confirm email they have no access toEPSS 0.3%CVE-2026-20808HIGHWindows File Explorer Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-20867HIGHWindows Management Services Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-25536HIGH@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuseEPSS 0.3%CVE-2026-82416HIGHFrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared moduleEPSS 0.3%CVE-2026-32242CRITICALParse Server OAuth2 adapter shares mutable state across providers via singleton instanceEPSS 0.3%CVE-2020-25651—A flaw was found in the SPICE file transfer protocol. File data from the host system can end up in full or in parts in the client connectionEPSS 0.3%CVE-2026-22851MEDIUMFreeRDP RDPGFX ResetGraphics race leads to use-after-free in SDL client (sdl->primary)EPSS 0.3%CVE-2026-83738HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-55318HIGHIn multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additionEPSS 0.3%CVE-2023-28144HIGHKDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involvingEPSS 0.3%CVE-2026-20830HIGHCapability Access Management Service (camsvc) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-20836HIGHDirectX Graphics Kernel Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-82364LOWmacrozheng mall Order Submission submit race conditionEPSS 0.3%CVE-2026-34342HIGHWindows Print Spooler Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-16212LOWawesto django-shop Purchase Stock inventory.py race conditionEPSS 0.3%CVE-2025-13036CRITICALRockwell Automation FactoryTalk Historian Site Edition - Authentication BypassEPSS 0.3%CVE-2026-87601HIGHRace condition in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.3%CVE-2026-17979HIGHRace in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pEPSS 0.3%CVE-2026-78901HIGHRace condition in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.3%