Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2023-37244MEDIUMPrivilege escalation in N-Able's AutomationManagerAgentEPSS 0.2%CVE-2025-62300MEDIUMHCL IntelliOps Event Management is affected by multiple security vulnerabilities.EPSS 0.2%CVE-2025-12432HIGHRace in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.EPSS 0.2%CVE-2026-77063LOWmulter vulnerable to file size limit bypass via async fileFilter race conditionEPSS 0.2%CVE-2024-40849HIGHA race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to break out of itsEPSS 0.2%CVE-2022-3521LOWLinux Kernel kcm kcmsock.c kcm_tx_work race conditionEPSS 0.2%CVE-2025-15242LOWPHPEMS Coupon race conditionEPSS 0.2%CVE-2026-17822MEDIUMRace in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML paEPSS 0.2%CVE-2026-7846LOWchatchat-space Langchain-Chatchat OpenAI-Compatible File Upload API openai_routes.py files toctouEPSS 0.2%CVE-2026-5893MEDIUMRace in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.EPSS 0.2%CVE-2026-17841MEDIUMRace in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML paEPSS 0.2%CVE-2026-17999MEDIUMRace in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a craftEPSS 0.2%CVE-2025-49678HIGHNTFS Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-10006HIGHRace in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a craftedEPSS 0.2%CVE-2025-32441MEDIUMRack session gets restored after deletionEPSS 0.2%CVE-2026-10940HIGHRace in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to poteEPSS 0.2%CVE-2020-27837—A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the EPSS 0.2%CVE-2021-20261—A race condition was found in the Linux kernels implementation of the floppy disk drive controller driver software. The impact of this issueEPSS 0.2%CVE-2026-8520HIGHRace in Payments in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTEPSS 0.2%CVE-2026-7960MEDIUMRace in Speech in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to obtain potentiaEPSS 0.2%