Falhas do tipo CWE-362

1.430 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2023-35361HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2020-25651—A flaw was found in the SPICE file transfer protocol. File data from the host system can end up in full or in parts in the client connectionEPSS 0.3%CVE-2022-45887MEDIUMAn issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of EPSS 0.3%CVE-2026-59896MEDIUMhono/jsx does not isolate context per request, leading to cross-request data disclosureEPSS 0.3%CVE-2026-113311HIGHRace condition in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass site isolation via a crafted HTMEPSS 0.3%CVE-2010-5169HIGHRace condition in Online Armor Premium 4.0.0.35 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous EPSS 0.3%CVE-2010-5159HIGHRace condition in Dr.Web Security Space Pro 6.0.0.03100 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute daEPSS 0.3%CVE-2025-12383CRITICALRace Condition allows Bypass of Trust RestrictionsEPSS 0.3%CVE-2026-43198CRITICALtcp: fix potential race in tcp_v6_syn_recv_sock()EPSS 0.3%CVE-2026-1220HIGHRace in V8 in Google Chrome prior to 144.0.7559.99 allowed a remote attacker to potentially exploit type confusion via a crafted HTML page. EPSS 0.3%CVE-2024-51505HIGHAn issue was discovered in Atos Eviden IDRA before 2.7.1. A highly trusted role (Config Admin) could leverage a race condition to escalate pEPSS 0.3%CVE-2026-32161HIGHWindows Native WiFi Miniport Driver Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-113059HIGHRace condition in Sensor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potenEPSS 0.3%CVE-2026-48505HIGHFilament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submissionEPSS 0.3%CVE-2026-112686LOWA race condition was addressed with improved locking. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS EPSS 0.3%CVE-2026-53070HIGHsctp: disable BH before calling udp_tunnel_xmit_skb()EPSS 0.3%CVE-2025-55223HIGHDirectX Graphics Kernel Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-54913HIGHWindows UI XAML Maps MapControlSettings Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-58616MEDIUMCopilot Chat (Microsoft Edge) Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-64865MEDIUMNew API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypassEPSS 0.3%