CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition) (page 20)
Page 20 of 26 — CVEs classified under CWE-362, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-12450 | Critical | 9.8 | 2019-05-29 | file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instea… |
CVE-2019-12448 | High | 8.1 | 2019-05-29 | An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement query_in… |
CVE-2019-10143 | High | 7.0 | 2019-05-24 | It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of th… |
CVE-2019-5796 | High | 7.5 | 2019-05-23 | Data race in extensions guest view in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2018-15664 | High | 7.5 | 2019-05-23 | In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving… |
CVE-2019-0114 | Medium | 4.7 | 2019-05-17 | A race condition in Intel(R) Graphics Drivers before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow an authenticated u… |
CVE-2019-8978 | High | 8.1 | 2019-05-14 | An improper authentication vulnerability can be exploited through a race condition that occurs in Ellucian Banner Web Tailor 8.8.3, 8.8.4, and 8.9 and Banner E… |
CVE-2019-11815 | High | 8.1 | 2019-05-08 | An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a race condition leading to a use-after-free, related… |
CVE-2018-20836 | High | 8.1 | 2019-05-07 | An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expand… |
CVE-2019-11675 | High | 7.0 | 2019-05-02 | The groonga-httpd package 6.1.5-1 for Debian sets the /var/log/groonga ownership to the groonga account, which might let local users obtain root access because… |
CVE-2019-11486 | High | 7.0 | 2019-04-23 | The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel before 5.0.8 has multiple race conditions. |
CVE-2015-1340 | High | 7.0 | 2019-04-22 | LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic l… |
CVE-2019-11191 | Low | 2.5 | 2019-04-12 | The Linux kernel through 5.0.7, when CONFIG_IA32_AOUT is enabled and ia32_aout is loaded, allows local users to bypass ASLR on setuid a.out programs (if any ex… |
CVE-2019-11190 | Medium | 4.7 | 2019-04-12 | The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_… |
CVE-2019-3837 | Medium | 6.1 | 2019-04-11 | It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace appl… |
CVE-2019-0217 | High | 7.5 | 2019-04-08 | In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credent… |
CVE-2018-4266 | Medium | 5.9 | 2019-04-03 | A race condition was addressed with additional validation. This issue affected versions prior toiVersions prior to: OS 11.4.1, tvOS 11.4.1, watchOS 4.3.2, Safa… |
CVE-2017-7151 | High | 7.0 | 2019-04-03 | A race condition was addressed with additional validation. This issue affected versions prior to iOS 11.2, macOS High Sierra 10.13.2, tvOS 11.2, watchOS 4.2, i… |
CVE-2018-18253 | High | 7.0 | 2019-03-15 | An issue was discovered in CapMon Access Manager 5.4.1.1005. CALRunElevated.exe attempts to enforce access control by adding an unprivileged user to the local… |
CVE-2019-9710 | High | 8.1 | 2019-03-12 | An issue was discovered in webargs before 5.1.3, as used with marshmallow and other products. JSON parsing uses a short-lived cache to store the parsed JSON bo… |
CVE-2018-18808 | High | 8.8 | 2019-03-07 | The domain management component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server f… |
CVE-2019-1992 | High | 7.5 | 2019-02-28 | In bta_hl_sdp_query_results of bta_hl_main.cc, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no add… |
CVE-2019-6974 | High | 8.1 | 2019-02-15 | In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-a… |
CVE-2018-9586 | High | 7.0 | 2019-02-11 | In run of InstallPackageTask.java in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, it is possible that package verificatio… |
CVE-2019-7718 | High | 8.1 | 2019-02-11 | An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP code via adm… |
CVE-2019-3461 | High | 7.0 | 2019-02-04 | Debian tmpreaper version 1.6.13+nmu1 has a race condition when doing a (bind) mount via rename() which could result in local privilege escalation. Mounting via… |
CVE-2016-10741 | Medium | 4.7 | 2019-02-01 | In the Linux kernel before 4.9.3, fs/xfs/xfs_aops.c allows local users to cause a denial of service (system crash) because there is a race condition between di… |
CVE-2018-11998 | High | 7.5 | 2019-01-18 | While processing a packet decode request in MQTT, Race condition can occur leading to an out-of-bounds access in snapdragon mobile and snapdragon wear in versi… |
CVE-2019-6133 | Medium | 6.7 | 2019-01-11 | In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are… |
CVE-2018-6158 | High | 7.5 | 2019-01-09 | A race condition in Oilpan in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-16079 | Medium | 5.3 | 2019-01-09 | A race condition between permission prompts and navigations in Prompts in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to spoof the contents o… |
CVE-2017-15405 | High | 7.0 | 2019-01-09 | Inappropriate symlink handling and a race condition in the stateful recovery feature implementation could lead to a persistance established by a malicious code… |
CVE-2018-17244 | Medium | 6.5 | 2018-12-20 | Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Nativ… |
CVE-2018-5198 | High | 8.1 | 2018-12-20 | In Veraport G3 ALL on MacOS, a race condition when calling the Veraport API allow remote attacker to cause arbitrary file download and execution. This results… |
CVE-2018-19489 | Medium | 4.7 | 2018-12-13 | v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renaming. |
CVE-2018-16867 | High | 7.8 | 2018-12-12 | A flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0. A path traversal in the in usb_mtp_write_data function in hw/usb/dev-mtp.c due to… |
CVE-2018-9519 | Medium | 6.4 | 2018-12-07 | In easelcomm_hw_build_scatterlist, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with Syste… |
CVE-2018-15332 | High | 7.0 | 2018-12-06 | The svpn component of the F5 BIG-IP APM client prior to version 7.1.7.2 for Linux and macOS runs as a privileged process and can allow an unprivileged user to… |
CVE-2018-19370 | Medium | 6.6 | 2018-11-28 | A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allow… |
CVE-2018-9539 | High | 7.0 | 2018-11-14 | In the ClearKey CAS descrambler, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additiona… |
CVE-2018-6061 | High | 7.5 | 2018-11-14 | A race in the handling of SharedArrayBuffers in WebAssembly in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corru… |
CVE-2018-15687 | High | 7.0 | 2018-10-26 | A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd v… |
CVE-2018-18559 | High | 8.1 | 2018-10-22 | In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This i… |
CVE-2018-7110 | Medium | 5.9 | 2018-10-17 | A remote unauthorized disclosure of information vulnerability was identified in HPE Service Governance Framework (SGF) version 4.2, 4.3. A race condition under… |
CVE-2018-0480 | Medium | 6.1 | 2018-10-05 | A vulnerability in the errdisable per VLAN feature of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause the device to crash, lea… |
CVE-2018-17972 | Medium | 5.5 | 2018-10-03 | An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through 4.18.11. It does not ensure that only root may inspect the… |
CVE-2018-9069 | Medium | 5.9 | 2018-10-02 | In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially a… |
CVE-2018-17364 | High | 8.1 | 2018-09-23 | OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter. |
CVE-2017-18302 | Medium | 4.7 | 2018-09-20 | In Snapdragon (Automobile ,Mobile) in version MSM8996AU, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDA660, SDM429, SD… |
CVE-2018-5905 | High | 7.0 | 2018-09-19 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a race condition while accessing num of clients in… |
CVE-2018-11818 | High | 7.0 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, LUT configuration is passed down to driver from use… |
CVE-2018-16976 | High | 8.1 | 2018-09-12 | Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of bei… |
CVE-2017-18347 | Medium | 4.6 | 2018-09-12 | Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physically present attackers to extract the device's protected firm… |
CVE-2018-14625 | Medium | 5.3 | 2018-09-10 | A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest. A race condition betwe… |
CVE-2018-15499 | Medium | 4.7 | 2018-08-24 | GEAR Software products that include GEARAspiWDM.sys, 2.2.5.0, allow local users to cause a denial of service (Race Condition and BSoD on Windows) by not checki… |
CVE-2018-15473 | Medium | 5.3 | 2018-08-17 | OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containi… |
CVE-2017-15358 | High | 7.0 | 2018-08-03 | Race condition in the Charles Proxy Settings suid binary in Charles Proxy before 4.2.1 allows local users to gain privileges via vectors involving the --self-r… |
CVE-2018-8037 | Medium | 5.9 | 2018-08-02 | If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result… |
CVE-2017-2616 | Medium | 5.5 | 2018-07-27 | A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this f… |
CVE-2017-7543 | Medium | 5.3 | 2018-07-26 | A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, fo… |
CVE-2018-14329 | Medium | 4.7 | 2018-07-17 | In HTSlib 1.8, a race condition in cram/cram_io.c might allow local users to overwrite arbitrary files via a symlink attack. |
CVE-2018-5873 | High | 7.0 | 2018-07-06 | An issue was discovered in the __ns_get_path function in fs/nsfs.c in the Linux kernel before 4.11. Due to a race condition when accessing files, a Use After F… |
CVE-2018-5859 | High | 7.0 | 2018-07-06 | Due to a race condition in the MDSS MDP driver in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) befor… |
CVE-2018-5853 | High | 7.0 | 2018-07-06 | A race condition exists in a driver in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security… |
CVE-2018-5832 | High | 7.0 | 2018-07-06 | Due to a race condition in a camera driver ioctl handler in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android)… |
CVE-2017-15856 | High | 7.0 | 2018-07-06 | Due to a race condition while processing the power stats debug file to read status, a double free condition can occur in Android releases from CAF using the li… |
CVE-2018-12691 | Medium | 6.8 | 2018-07-05 | Time-of-check to time-of-use (TOCTOU) race condition in org.onosproject.acl (aka the access control application) in ONOS v1.13 and earlier allows attackers to… |
CVE-2018-8025 | High | 8.1 | 2018-06-27 | CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could… |
CVE-2018-12633 | Medium | 6.3 | 2018-06-22 | An issue was discovered in the Linux kernel through 4.17.2. vbg_misc_device_ioctl() in drivers/virt/vboxguest/vboxguest_linux.c reads the same user data twice… |
CVE-2018-5236 | Medium | 5.3 | 2018-06-20 | Symantec Endpoint Protection prior to 14 RU1 MP1 or 12.1 RU6 MP10 may be susceptible to a race condition (or race hazard). This type of issue occurs in softwar… |
CVE-2018-12029 | High | 7.0 | 2018-06-17 | A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_inst… |
CVE-2018-1121 | Low | 3.9 | 2018-06-13 | procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric orde… |
CVE-2018-10850 | Medium | 5.9 | 2018-06-13 | 389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the s… |
CVE-2018-3759 | Low | 3.7 | 2018-06-13 | private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being c… |
CVE-2018-5849 | High | 7.0 | 2018-06-12 | Due to a race condition in the QTEECOM driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, when… |
CVE-2017-15843 | High | 7.0 | 2018-06-12 | Due to a race condition in a bus driver, a double free in msm_bus_floor_vote_context() can potentially occur in all Android releases from CAF (Android for MSM… |
CVE-2018-5814 | High | 7.0 | 2018-06-12 | In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and 4.4.133, multiple race condition errors when handling probe, disconnect, and rebind operation… |
CVE-2018-12232 | Medium | 5.9 | 2018-06-12 | In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where they target the same socket file descri… |
CVE-2017-5427 | Medium | 5.5 | 2018-06-11 | A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. If a malicious user with local access put… |
CVE-2016-9077 | High | 7.0 | 2018-06-11 | Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin. The rendering by the filter is variable depending on the input pixel, al… |
CVE-2018-4230 | High | 7.0 | 2018-06-08 | An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "NVIDIA Graphics Drivers" component. It allows atta… |
CVE-2018-4228 | High | 7.0 | 2018-06-08 | An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "IOFireWireAVC" component. It allows attackers to e… |
CVE-2018-4192 | High | 7.5 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTu… |
CVE-2018-5845 | High | 7.0 | 2018-06-06 | A race condition in drm_atomic_nonblocking_commit() in the display driver can potentially lead to a Use After Free scenario in all Android releases from CAF (A… |
CVE-2016-10538 | Low | 3.5 | 2018-05-31 | The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any f… |
CVE-2018-6236 | High | 7.0 | 2018-05-25 | A Time-of-Check Time-of-Use privilege escalation vulnerability in Trend Micro Maximum Security (Consumer) 2018 could allow a local attacker to escalate privile… |
CVE-2018-11324 | Medium | 5.9 | 2018-05-22 | An issue was discovered in Joomla! Core before 3.8.8. A long running background process, such as remote checks for core or extension updates, could create a ra… |
CVE-2009-5152 | Medium | 4.1 | 2018-05-11 | Absolute Computrace Agent, as distributed on certain Dell Inspiron systems through 2009, has a race condition with the Dell Client Configuration Utility (DCCU)… |
CVE-2018-8897 | High | 7.8 | 2018-05-08 | A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some… |
CVE-2016-9038 | High | 7.8 | 2018-04-24 | An exploitable double fetch vulnerability exists in the SboxDrv.sys driver functionality of Invincea-X 6.1.3-24058. A specially crafted input buffer and race c… |
CVE-2016-10439 | High | 8.1 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, SD 650/52… |
CVE-2016-10435 | High | 8.1 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9625, MDM963… |
CVE-2016-10433 | High | 8.1 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9635M, MDM9640, MDM96… |
CVE-2016-10432 | High | 8.1 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 410/12, SD 425, SD 430, SD 450, SD 617… |
CVE-2016-10417 | High | 8.1 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM960… |
CVE-2016-10409 | High | 8.1 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, SD 650/52… |
CVE-2015-9157 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MS… |
CVE-2015-9016 | High | 7.0 | 2018-04-05 | In blk_mq_tag_to_rq in blk-mq.c in the upstream kernel, there is a possible use after free due to a race condition when a request has been previously freed by… |
CVE-2018-5826 | Medium | 5.9 | 2018-04-03 | In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-… |
CVE-2017-14880 | High | 7.8 | 2018-04-03 | In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-… |