Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2020-29372MEDIUMAn issue was discovered in do_madvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operationEPSS 0.4%CVE-2026-48708HIGHOliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command ContaminationEPSS 0.4%CVE-2016-15036MEDIUMDeis Workflow Manager race conditionEPSS 0.4%CVE-2025-15244MEDIUMPHPEMS Purchase Request race conditionEPSS 0.4%CVE-2024-24770MEDIUMUsername timing attack on recover password/MFA token in vantage6EPSS 0.4%CVE-2026-42909HIGHRemote Desktop Client Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-64779LOWA memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10,EPSS 0.4%CVE-2026-28789HIGHOliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handlingEPSS 0.4%CVE-2025-48880MEDIUMFreeScout has Race Condition When Deleting UsersEPSS 0.4%CVE-2022-50373CRITICALfs: dlm: fix race in lowcommsEPSS 0.4%CVE-2022-42930HIGHIf two Workers were simultaneously initializing their CacheStorage, a data race could have occurred in the `ThirdPartyUtil` component. This EPSS 0.4%CVE-2026-17709CRITICALRace in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potenEPSS 0.4%CVE-2025-7954MEDIUMRace Condition in Shopware Voucher SubmissionEPSS 0.4%CVE-2024-0605HIGHUsing a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bEPSS 0.4%CVE-2026-19506HIGHRDK-B WebUI race condition vulnerabilityEPSS 0.4%CVE-2024-20509MEDIUMA vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unEPSS 0.4%CVE-2026-51082HIGHA race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-manager before 9.1.9 and 8.x bEPSS 0.4%CVE-2025-29841HIGHUniversal Print Management Service Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2022-3328HIGHRace condition in snap-confine's must_mkdir_and_open_with_perms()EPSS 0.4%CVE-2024-12747MEDIUMRsync: race condition in rsync handling symbolic linksEPSS 0.4%