Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2025-13231MEDIUMFancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Server-Side Request Forgery via Race ConditionEPSS 0.2%CVE-2025-24094MEDIUMA race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.EPSS 0.2%CVE-2026-59321MEDIUMShared JSR-223 ScriptEngine evaluated concurrently without THREADING checkEPSS 0.2%CVE-2026-17724MEDIUMRace in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) vEPSS 0.2%CVE-2021-0298MEDIUMJunos OS Evolved: PTX10003, PTX10008: picd core while executing the "show chassis pic" command under certain conditionsEPSS 0.2%CVE-2026-34850LOWRace condition vulnerability in the notification service. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.2%CVE-2026-10654LOWRFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth ClassicEPSS 0.2%CVE-2025-43292MEDIUMA race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7, macOS Sequoia 15.7.2, macOS Tahoe 26EPSS 0.2%CVE-2025-71066HIGHnet/sched: ets: Always remove class from active list before deleting in ets_qdisc_changeEPSS 0.2%CVE-2025-21701HIGHnet: avoid race between device unregistration and ethnl opsEPSS 0.2%CVE-2024-23275MEDIUMA race condition was addressed with additional validation. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13EPSS 0.2%CVE-2024-53100HIGHnvme: tcp: avoid race between queue_lock lock and destroyEPSS 0.2%CVE-2024-23196MEDIUMRace condition vulnerability in Linux kernel sound/hda snd_hdac_regmap_syncEPSS 0.2%CVE-2025-21943MEDIUMgpio: aggregator: protect driver attr handlers against module unloadEPSS 0.2%CVE-2025-52517MEDIUMAn issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. A race cEPSS 0.2%CVE-2026-15995MEDIUMIBM Cognos Analytics 12.1.3 general availability package contains a data integrity issue in the Agentic AI assistant that may cause incorrect report summaries or report-processing errors under concurrent useEPSS 0.2%CVE-2026-91723MEDIUMRace condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML pEPSS 0.2%CVE-2026-12022HIGHRace in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to EPSS 0.2%CVE-2026-1199MEDIUMAPI and Frontend login lockout race conditionEPSS 0.2%CVE-2024-50135MEDIUMnvme-pci: fix race condition between reset and nvme_dev_disable()EPSS 0.2%