Weaknesses of type CWE-362

943 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2023-36884HIGHWindows Search Remote Code Execution VulnerabilityEPSS 98.9%KEVCVE-2018-15473MEDIUMOpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after EPSS 98.6%CVE-2024-27983HIGHAn attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 fEPSS 87.2%CVE-2016-5195HIGHRace condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect haEPSS 83.0%KEVCVE-2023-28126MEDIUMAn authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploitinEPSS 66.7%CVE-2022-46689HIGHA race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOEPSS 44.7%CVE-2021-21166HIGHData race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTMEPSS 23.8%KEVCVE-2014-0196MEDIUMThe n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO EPSS 22.5%KEVCVE-2024-28999MEDIUMSolarWinds Platform Race Condition VulnerabilityEPSS 13.9%CVE-2010-0021MEDIUMMultiple race conditions in the SMB implementation in the Server service in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 EPSS 13.5%CVE-2017-2619—Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the servEPSS 11.2%CVE-2022-26904HIGHWindows User Profile Service Elevation of Privilege VulnerabilityEPSS 9.8%KEVCVE-2025-21376HIGHWindows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityEPSS 9.4%CVE-2023-40077CRITICALIn multiple functions of MetaDataBase.cpp, there is a possible UAF write due to a race condition. This could lead to remote escalation of prEPSS 8.4%CVE-2018-1049—In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be servEPSS 7.2%CVE-2020-6820HIGHUnder certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in tEPSS 6.3%KEVCVE-2025-62215HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 6.0%KEVCVE-2024-48991HIGHQualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race conditionEPSS 5.3%CVE-2024-20700HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 4.0%CVE-2025-50177HIGHMicrosoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityEPSS 3.9%