Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2026-58531HIGHWindows SMB Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2024-47534HIGHIncorrect delegation lookups can make go-tuf download the wrong artifactEPSS 0.5%CVE-2025-49743MEDIUMWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-62778HIGHWindows DNS Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2024-42488MEDIUMCilium agent's race condition may lead to policy bypass for Host Firewall policyEPSS 0.5%CVE-2022-36318MEDIUMWhen visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerability affects Firefox ESREPSS 0.5%CVE-2024-22047LOWAudited Log Integrity Errors Due to Race ConditionEPSS 0.5%CVE-2022-0279—AnyComment < 0.2.18 - Comment Rating Increase/Decrease via Race ConditionEPSS 0.5%CVE-2024-27876HIGHA race condition was addressed with improved locking. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 1EPSS 0.5%CVE-2026-28982CRITICALA race condition was addressed with improved locking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A EPSS 0.5%CVE-2026-61920MEDIUMWindows DNS Server Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-69364HIGHWindows Print Spooler Components Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-55231HIGHWindows Storage-based Management Service Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-46727HIGHAn issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handleEPSS 0.5%CVE-2025-55226MEDIUMGraphics Kernel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2023-36698MEDIUMWindows Kernel Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2021-23133MEDIUMLinux Kernel sctp_destroy_sock race conditionEPSS 0.5%CVE-2026-42913HIGHRemote Desktop Client Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-55191MEDIUMRepository Credentials Race Condition Crashes Argo CD ServerEPSS 0.5%CVE-2021-46873MEDIUMWireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim's EPSS 0.5%