CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition) (page 19)
Page 19 of 26 — CVEs classified under CWE-362, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-0066 | Medium | 6.4 | 2020-03-10 | In the netlink driver, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution… |
CVE-2020-0045 | Medium | 6.4 | 2020-03-10 | In StatsService::command of StatsService.cpp, there is possible memory corruption due to a race condition. This could lead to local escalation of privilege wit… |
CVE-2020-10237 | Medium | 5.5 | 2020-03-09 | An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permiss… |
CVE-2020-10174 | High | 7.0 | 2020-03-05 | init_tmp in TeeJee.FileSystem.vala in Timeshift before 20.03 unsafely reuses a preexisting temporary directory in the predictable location /tmp/timeshift. It f… |
CVE-2019-14072 | High | 7.0 | 2020-03-05 | Unhandled paging request is observed due to dereferencing an already freed object because of race condition between sparse free and sparse bind ioctls which ac… |
CVE-2020-3831 | High | 7.0 | 2020-02-27 | A race condition was addressed with improved locking. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. An application may be able to execute arbitrary code… |
CVE-2020-9329 | Medium | 5.9 | 2020-02-21 | Gogs through 0.11.91 allows attackers to violate the admin-specified repo-creation policy due to an internal/db/repo.go race condition. |
CVE-2011-0699 | High | 7.0 | 2020-02-20 | Integer signedness error in the btrfs_ioctl_space_info function in the Linux kernel 2.6.37 allows local users to cause a denial of service (heap-based buffer o… |
CVE-2020-3163 | Medium | 5.9 | 2020-02-19 | A vulnerability in the Live Data server of Cisco Unified Contact Center Enterprise could allow an unauthenticated, remote attacker to cause a denial of service… |
CVE-2020-1814 | Medium | 5.3 | 2020-02-18 | Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C… |
CVE-2019-11215 | High | 8.1 | 2020-02-14 | In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader wit… |
CVE-2020-0030 | High | 7.0 | 2020-02-13 | In binder_thread_release of binder.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no addi… |
CVE-2013-3685 | High | 7.0 | 2020-02-12 | A Privilege Escalation Vulnerability exists in Sprite Software Spritebud 1.3.24 and 1.3.28 and Backup 2.5.4105 and 2.5.4108 on LG Android smartphones due to a… |
CVE-2014-9748 | High | 8.1 | 2020-02-11 | The uv_rwlock_t fallback implementation for Windows XP and Server 2003 in libuv before 1.7.4 does not properly prevent threads from releasing the locks of othe… |
CVE-2020-6388 | High | 8.8 | 2020-02-11 | Out of bounds access in WebAudio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2019-18567 | Medium | 6.3 | 2020-02-03 | Bromium client version 4.0.3.2060 and prior to 4.1.7 Update 1 has an out of bound read results in race condition causing Kernel memory leaks or denial of servi… |
CVE-2019-3016 | Medium | 6.2 | 2020-01-31 | In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This p… |
CVE-2014-3856 | High | 7.0 | 2020-01-28 | The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain privileges via a te… |
CVE-2014-2906 | High | 7.0 | 2020-01-28 | The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands… |
CVE-2019-18932 | High | 7.0 | 2020-01-21 | log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a fixed temporary directory /tmp/sarg. As… |
CVE-2019-20384 | Medium | 5.5 | 2020-01-21 | Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging access to the nagios u… |
CVE-2019-19278 | Medium | 6.8 | 2020-01-16 | A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 Drives MLFB 6SR32..-.....-.... MLFB 6SR4...-.....-.... MLFB 6SR5...-.....-.... With optio… |
CVE-2020-3941 | High | 7.0 | 2020-01-15 | The repair operation of VMware Tools for Windows 10.x.y has a race condition which may allow for privilege escalation in the Virtual Machine where Tools is ins… |
CVE-2007-4774 | Medium | 5.9 | 2020-01-15 | The Linux kernel before 2.4.36-rc1 has a race condition. It was possible to bypass systrace policies by flooding the ptraced process with SIGCONT signals, whic… |
CVE-2019-17021 | Medium | 5.3 | 2020-01-08 | During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process… |
CVE-2019-17011 | High | 7.5 | 2020-01-08 | Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a po… |
CVE-2019-17010 | High | 7.5 | 2020-01-08 | Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-f… |
CVE-2019-11761 | Medium | 5.4 | 2020-01-08 | By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this o… |
CVE-2020-0008 | Medium | 4.7 | 2020-01-08 | In LowEnergyClient::MtuChangedCallback of low_energy_client.cc, there is a possible out of bounds read due to a race condition. This could lead to local inform… |
CVE-2014-0245 | Medium | 5.9 | 2020-01-02 | It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe. For a specific WSRP endpoint, under high-co… |
CVE-2011-3585 | Medium | 4.7 | 2019-12-31 | Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow local users to cause a denial of service (mounting outage) via a… |
CVE-2019-11090 | Medium | 5.9 | 2019-12-18 | Cryptographic timing conditions in the subsystem for Intel(R) PTT before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0 and 14.0.10; Intel(R) TXE 3.1.70… |
CVE-2019-8757 | Low | 2.5 | 2019-12-18 | A race condition existed when reading and writing user preferences. This was addressed with improved state handling. This issue is fixed in macOS Catalina 10.1… |
CVE-2019-8606 | High | 7.0 | 2019-12-18 | A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Mojave 10.1… |
CVE-2019-8565 | High | 7.0 | 2019-12-18 | A race condition was addressed with additional validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4. A malicious application may be able to gain r… |
CVE-2019-6236 | High | 7.5 | 2019-12-18 | A race condition existed during the installation of iCloud for Windows. This was addressed with improved state handling. This issue is fixed in iCloud for Wind… |
CVE-2019-6232 | High | 7.5 | 2019-12-18 | A race condition existed during the installation of iTunes for Windows. This was addressed with improved state handling. This issue is fixed in iCloud for Wind… |
CVE-2019-16779 | Medium | 5.8 | 2019-12-16 | In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would… |
CVE-2019-18827 | Medium | 5.9 | 2019-12-16 | On Barco ClickShare Button R9861500D01 devices (before firmware version 1.9.0) JTAG access is disabled after ROM code execution. This means that JTAG access is… |
CVE-2014-3701 | High | 8.1 | 2019-12-15 | eDeploy has tmp file race condition flaws |
CVE-2019-19580 | Medium | 6.6 | 2019-12-11 | An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion an… |
CVE-2019-2219 | Medium | 4.7 | 2019-12-06 | In several functions of NotificationManagerService.java and related files, there is a possible way to record audio from the background without notification to… |
CVE-2019-19537 | Medium | 4.2 | 2019-12-03 | In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the USB character device driver layer, aka CID… |
CVE-2019-19017 | High | 8.1 | 2019-12-02 | An issue was discovered in TitanHQ WebTitan before 5.18. The appliance has a hard-coded root password set during installation. An attacker could utilize this t… |
CVE-2014-5255 | High | 7.0 | 2019-11-21 | xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files. Note: A different… |
CVE-2014-5254 | Medium | 4.7 | 2019-11-21 | xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files. |
CVE-2016-1000236 | Medium | 4.4 | 2019-11-19 | Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used. |
CVE-2019-2213 | High | 7.4 | 2019-11-13 | In binder_free_transaction of binder.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no ad… |
CVE-2019-5228 | High | 7.8 | 2019-11-12 | Certain detection module of P30, P30 Pro, Honor V20 smartphone whith Versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21), Versions earlier than VOGUE-AL00… |
CVE-2019-1416 | High | 7.0 | 2019-11-12 | An elevation of privilege vulnerability exists due to a race condition in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux Elevation of Privilege… |
CVE-2009-4011 | High | 8.1 | 2019-11-09 | dtc-xen 0.5.x before 0.5.4 suffers from a race condition where an attacker could potentially get a bash access as xenXX user on the dom0, and then access a pot… |
CVE-2019-10529 | High | 8.1 | 2019-11-06 | Possible use after free issue due to race condition while attempting to mark the entry pages as dirty using function set_page_dirty() in Snapdragon Auto, Snapd… |
CVE-2006-4245 | High | 8.1 | 2019-11-06 | archivemail 0.6.2 uses temporary files insecurely leading to a possible race condition. |
CVE-2019-8232 | Medium | 6.6 | 2019-11-06 | In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authenticated user with adm… |
CVE-2019-18684 | High | 7.0 | 2019-11-04 | Sudo through 1.8.29 allows local users to escalate to root if they have write access to file descriptor 3 of the sudo process. This occurs because of a race co… |
CVE-2019-18683 | High | 7.0 | 2019-11-04 | An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privilege escalation on some Linux distributio… |
CVE-2005-2352 | High | 8.1 | 2019-11-01 | I race condition in Temp files was found in gs-gpl before 8.56 addons scripts. |
CVE-2019-18421 | High | 7.5 | 2019-10-31 | An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion an… |
CVE-2019-8162 | High | 8.1 | 2019-10-17 | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.00… |
CVE-2019-14810 | Medium | 5.9 | 2019-10-10 | A vulnerability has been found in the implementation of the Label Distribution Protocol (LDP) protocol in EOS. Under race conditions, the LDP agent can establi… |
CVE-2019-6471 | Medium | 5.9 | 2019-10-09 | A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c. Versions affect… |
CVE-2019-17342 | High | 7.0 | 2019-10-08 | An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a race condition tha… |
CVE-2019-17341 | High | 7.8 | 2019-10-08 | An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a page-writability r… |
CVE-2019-2284 | High | 7.0 | 2019-09-30 | Possible use-after-free issue due to a race condition while calling camera ioctl concurrently in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Indust… |
CVE-2019-9375 | Medium | 6.4 | 2019-09-27 | In hostapd, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges… |
CVE-2019-2189 | Medium | 6.4 | 2019-09-27 | In the Easel driver, there is possible memory corruption due to race conditions. This could lead to local escalation of privilege with System execution privile… |
CVE-2019-2188 | Medium | 6.4 | 2019-09-27 | In the Easel driver, there is possible memory corruption due to race conditions. This could lead to local escalation of privilege with System execution privile… |
CVE-2019-11736 | High | 7.0 | 2019-09-27 | The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local f… |
CVE-2019-11184 | Medium | 4.8 | 2019-09-16 | A race condition in specific microprocessors using Intel (R) DDIO cache allocation and RDMA may allow an authenticated user to potentially enable partial infor… |
CVE-2019-16354 | Medium | 4.7 | 2019-09-16 | The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory… |
CVE-2019-11546 | Medium | 5.3 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has a Race Condition wh… |
CVE-2019-9458 | High | 7.0 | 2019-09-06 | In the Android kernel in the video driver there is a use after free due to a race condition. This could lead to local escalation of privilege with no additiona… |
CVE-2019-9450 | Medium | 6.4 | 2019-09-06 | In the Android kernel in the FingerTipS touchscreen driver there is a possible memory corruption due to a race condition. This could lead to local escalation o… |
CVE-2019-9271 | Medium | 6.4 | 2019-09-06 | In the Android kernel in the mnh driver there is a race condition due to insufficient locking. This could lead to a use-after-free which could lead to escalati… |
CVE-2019-5612 | High | 7.5 | 2019-08-30 | In FreeBSD 12.0-STABLE before r351264, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r351265, 11.3-RELEASE before 11.3-RELEASE-p3, and 11.2-RELEASE… |
CVE-2019-14694 | Medium | 4.7 | 2019-08-28 | A use-after-free flaw in the sandbox container implemented in cmdguard.sys in Comodo Antivirus 12.0.0.6870 can be triggered due to a race condition when handli… |
CVE-2019-2121 | High | 7.0 | 2019-08-20 | In ActivityManagerService.attachApplication of ActivityManagerService, there is a possible race condition. This could lead to local escalation of privilege wit… |
CVE-2016-10906 | High | 7.0 | 2019-08-19 | An issue was discovered in drivers/net/ethernet/arc/emac_main.c in the Linux kernel before 4.5. A use-after-free is caused by a race condition between the func… |
CVE-2019-3744 | High | 7.8 | 2019-08-09 | Dell/Alienware Digital Delivery versions prior to 4.0.41 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a Un… |
CVE-2019-12263 | High | 8.1 | 2019-08-09 | Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in the TCP component (issue 4 of 4). There is an IPNET security vulnerability: TCP Urgent Pointer state… |
CVE-2016-10798 | Medium | 6.8 | 2019-08-07 | cPanel before 58.0.4 allows a file-ownership change (to nobody) via rearrangeacct (SEC-134). |
CVE-2018-20940 | Low | 3.3 | 2019-08-01 | cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups (SEC-342). |
CVE-2019-7614 | Medium | 5.9 | 2019-07-30 | A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users sub… |
CVE-2019-11922 | High | 8.1 | 2019-07-25 | A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output bu… |
CVE-2019-2345 | High | 7.0 | 2019-07-25 | Race condition while accessing DMA buffer in jpeg driver in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapd… |
CVE-2019-2314 | High | 7.0 | 2019-07-25 | Possible race condition that will cause a use-after-free when writing to two sysfs entries at nearly the same time in Snapdragon Compute, Snapdragon Consumer I… |
CVE-2019-9821 | High | 8.1 | 2019-07-23 | A use-after-free vulnerability can occur in AssertWorkerThread due to a race condition with shared workers. This results in a potentially exploitable crash. Th… |
CVE-2019-9818 | High | 8.3 | 2019-07-23 | A race condition is present in the crash generation server used to generate data for the crash reporter. This issue can lead to a use-after-free in the main pr… |
CVE-2019-2260 | High | 7.0 | 2019-07-22 | A race condition occurs while processing perf-event which can lead to a use after free condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IO… |
CVE-2018-19572 | Medium | 5.9 | 2019-07-10 | GitLab CE 8.17 and later and EE 8.3 and later have a symlink time-of-check-to-time-of-use race condition that would allow unauthorized access to files in the G… |
CVE-2019-13233 | High | 7.0 | 2019-07-04 | In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an LDT entry because of a race condition between modify_l… |
CVE-2019-13226 | High | 7.0 | 2019-07-04 | deepin-clone before 1.1.3 uses a predictable path /tmp/.deepin-clone/mount/<block-dev-basename> in the Helper::temporaryMountDevice() function to temporarily m… |
CVE-2019-6627 | Medium | 5.9 | 2019-07-03 | On F5 SSL Orchestrator 14.1.0-14.1.0.5, on rare occasions, specific to a certain race condition, TMM may restart when SSL Forward Proxy enforces the bypass act… |
CVE-2019-13178 | High | 8.1 | 2019-07-02 | modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and… |
CVE-2019-5840 | Medium | 4.3 | 2019-06-27 | Incorrect security UI in popup blocker in Google Chrome on iOS prior to 75.0.3770.80 allowed a remote attacker to bypass navigation restrictions via a crafted… |
CVE-2019-2008 | High | 7.5 | 2019-06-19 | In createEffect of AudioFlinger.cpp, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no ad… |
CVE-2019-2006 | Critical | 9.8 | 2019-06-19 | In serviceDied of HalDeathHandlerHidl.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege in t… |
CVE-2018-13909 | High | 7.0 | 2019-06-14 | Metadata verification and partial hash system calls by bootloader may corrupt parallel hashing state in progress resulting in unexpected behavior in Snapdragon… |
CVE-2019-2095 | High | 7.0 | 2019-06-07 | In callGenIDChangeListeners and related functions of SkPixelRef.cpp, there is a possible use after free due to a race condition. This could lead to remote code… |
CVE-2019-5216 | High | 7.0 | 2019-06-06 | There is a race condition vulnerability on Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.156(C00E156R2P14T8), Honor 10 smartphones ver… |