Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2026-20815HIGHCapability Access Management Service (camsvc) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-20861HIGHWindows Management Services Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-1220HIGHRace in V8 in Google Chrome prior to 144.0.7559.99 allowed a remote attacker to potentially exploit type confusion via a crafted HTML page. EPSS 0.3%CVE-2024-51505HIGHAn issue was discovered in Atos Eviden IDRA before 2.7.1. A highly trusted role (Config Admin) could leverage a race condition to escalate pEPSS 0.3%CVE-2026-20874HIGHWindows Management Services Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-20869HIGHWindows Local Session Manager (LSM) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-48505HIGHFilament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submissionEPSS 0.3%CVE-2026-79014MEDIUMRace condition in Autofill in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypEPSS 0.3%CVE-2025-23259MEDIUMNVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver (PMD), where an attacker on a VM in the system might be able to cause infoEPSS 0.3%CVE-2026-87816HIGHPasswordPusher before 2.11.1 Race Condition View Limit BypassEPSS 0.3%CVE-2026-44693HIGHPi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session BufferEPSS 0.3%CVE-2020-10737MEDIUMA race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the hoEPSS 0.3%CVE-2025-54913HIGHWindows UI XAML Maps MapControlSettings Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-55223HIGHDirectX Graphics Kernel Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2022-45887MEDIUMAn issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of EPSS 0.3%CVE-2025-13036CRITICALRockwell Automation FactoryTalk Historian Site Edition - Authentication BypassEPSS 0.3%CVE-2026-34342HIGHWindows Print Spooler Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-16212LOWawesto django-shop Purchase Stock inventory.py race conditionEPSS 0.3%CVE-2023-28144HIGHKDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involvingEPSS 0.3%CVE-2025-48000HIGHWindows Connected Devices Platform Service Elevation of Privilege VulnerabilityEPSS 0.3%