Fallos del tipo CWE-362

1433 resultados

Condição de corrida (Race Condition)

Ocorre quando múltiplas threads ou processos acessam e modificam um recurso compartilhado (arquivo, variável, banco de dados) sem sincronização adequada. O resultado final depende da ordem de execução, que é imprevisível, permitindo que um atacante manipule o timing para causar comportamento não autorizado ou corrupção de dados.

Ejemplo

Um aplicativo web verifica se um usuário tem saldo antes de debitar uma transação, mas não mantém lock entre a verificação e o débito. Um atacante dispara dois saques simultâneos da mesma conta; ambos passam na validação antes que qualquer um tenha atualizado o saldo, resultando em saque maior que o disponível.

Cómo mitigar

Use mecanismos de sincronização (mutex, semáforos, locks) ao acessar recursos compartilhados, ou implemente operações atômicas que garantam que verificação e modificação ocorram como uma única unidade indivisível. Em bases de dados, use transações com isolamento adequado (SERIALIZABLE quando necessário).

CVE-2026-15119HIGHRace in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentiaEPSS 0.2%CVE-2024-40849HIGHA race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to break out of itsEPSS 0.2%CVE-2026-32398MEDIUMWordPress TeraWallet – For WooCommerce plugin <= 1.5.15 - Race Condition vulnerabilityEPSS 0.2%CVE-2026-70640HIGHllama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cppEPSS 0.2%CVE-2026-23461HIGHBluetooth: L2CAP: Fix use-after-free in l2cap_unregister_userEPSS 0.2%CVE-2026-21221HIGHCapability Access Management Service (camsvc) Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-47741MEDIUMShopper: Race condition on Discount.usage_limit allows silent over-redemptionEPSS 0.2%CVE-2026-79094MEDIUMRace condition in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a craftEPSS 0.2%CVE-2025-15242LOWPHPEMS Coupon race conditionEPSS 0.2%CVE-2026-40178MEDIUMajenti.plugin.core has a race conditions in 2FAEPSS 0.2%CVE-2022-3521LOWLinux Kernel kcm kcmsock.c kcm_tx_work race conditionEPSS 0.2%CVE-2019-3837MEDIUMIt was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threEPSS 0.2%CVE-2026-34368MEDIUMAVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalanceEPSS 0.2%CVE-2026-116403MEDIUMWordPress Easy Digital Downloads plugin <= 3.7.1 - Race Condition vulnerabilityEPSS 0.2%CVE-2022-27481—A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions < V3.0.0), SCALANCE W1788-2 EEC M12 (All versions < V3.0.0), SCALAEPSS 0.2%CVE-2026-84522MEDIUMA race condition was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access senEPSS 0.2%CVE-2026-43930LOWParse Server: MFA SMS one-time password accepted twice under concurrent loginEPSS 0.2%CVE-2026-23671HIGHWindows Bluetooth RFCOM Protocol Driver Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-82258MEDIUMSvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batchEPSS 0.2%CVE-2026-81971HIGHWindows NTFS Elevation of Privilege VulnerabilityEPSS 0.2%