CVE-2017-7151: Concurrent Execution using Shared Resource with Improper Synchronization

A race condition was addressed with additional validation. This issue affected versions prior to iOS 11.2, macOS High Sierra 10.13.2, tvOS 11.2, watchOS 4.2, iTunes 12.7.2 for Windows, macOS High Sierra 10.13.4...

CVE-2018-18253: Concurrent Execution using Shared Resource with Improper Synchronization

An issue was discovered in CapMon Access Manager 5.4.1.1005. CALRunElevated.exe attempts to enforce access control by adding an unprivileged user to the local Administrators group for a very short time to execute a single command. However, the user is left in that group if the command crashes, an...

CVE-2019-9710: Concurrent Execution using Shared Resource with Improper Synchronization

An issue was discovered in webargs before 5.1.3, as used with marshmallow and other products. JSON parsing uses a short-lived cache to store the parsed JSON body. This cache is not thread-safe, meaning that incorrect JSON payloads could have been parsed for concurrent requests...

CVE-2019-6133: Concurrent Execution using Shared Resource with Improper Synchronization

In PolicyKit aka polkit 0.115, the "start time" protection mechanism can be bypassed because fork is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c...

CVE-2018-17244: Concurrent Execution using Shared Resource with Improper Synchronization

Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; wh...

CVE-2018-17972: Concurrent Execution using Shared Resource with Improper Synchronization

An issue was discovered in the procpidstack function in fs/proc/base.c in the Linux kernel through 4.18.11. It does not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a local attacker to exploit racy stack unwinding and leak kernel task stack contents...

CVE-2018-9069: Concurrent Execution using Shared Resource with Improper Synchronization

In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially allowing an attacker with administrator access to alter the contents of BIOS...

CVE-2017-18302: Concurrent Execution using Shared Resource with Improper Synchronization

In Snapdragon Automobile ,Mobile in version MSM8996AU, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SnapdragonHighMed2016, a crafted HLOS client can modify the structure in memory passed to a QSEE...

CVE-2018-16976: Concurrent Execution using Shared Resource with Improper Synchronization

Gitolite before 3.6.9 does not in certain configurations involving @all or a regex properly restrict access to a Git repository that is in the process of being migrated until the full set of migration steps has been completed. This can allow valid users to obtain unintended access...

CVE-2018-8025: Concurrent Execution using Shared Resource with Improper Synchronization

CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticated sessions being incorrectly applied to users, e.g. one authenticated user would be considered a different user or an...

CVE-2018-5236: Concurrent Execution using Shared Resource with Improper Synchronization

Symantec Endpoint Protection prior to 14 RU1 MP1 or 12.1 RU6 MP10 may be susceptible to a race condition or race hazard. This type of issue occurs in software where the output is dependent on the sequence or timing of other uncontrollable events...

CVE-2016-9077: Concurrent Execution using Shared Resource with Improper Synchronization

Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin. The rendering by the filter is variable depending on the input pixel, allowing for timing attacks when the images are loaded from third party locations. This vulnerability affects Firefox 50...

CVE-2017-5427: Concurrent Execution using Shared Resource with Improper Synchronization

A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. If a malicious user with local access puts chrome.manifest and other referenced files in this directory, they will be loaded and activated during startup. This could result in...

CVE-2016-10432: Concurrent Execution using Shared Resource with Improper Synchronization

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 410/12, SD 425, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 820, and SD 820A, TOCTOU vulnerabilities may occur while sanitizing userspace values passed to tQSEE system call...

CVE-2017-16512: Concurrent Execution using Shared Resource with Improper Synchronization

The vagrant update process in Hashicorp vagrant-vmware-fusion 5.0.2 through 5.0.4 allows local users to steal root privileges via a crafted update request when no updates are available...

CVE-2017-2619: Concurrent Execution using Shared Resource with Improper Synchronization

Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the server file system not exported under the share definition...

CVE-2018-7441: Concurrent Execution using Shared Resource with Improper Synchronization

Leptonica through 1.75.3 uses hardcoded /tmp pathnames, which might allow local users to overwrite arbitrary files or have unspecified other impact by creating files in advance or winning a race condition, as demonstrated by /tmp/junksplitimage.ps in prog/splitimage2pdf.c...

CVE-2017-1000503: Concurrent Execution using Shared Resource with Improper Synchronization

A race condition during Jenkins 2.81 through 2.94 inclusive; 2.89.1 startup could result in the wrong order of execution of commands during initialization. This could in rare cases result in failure to initialize the setup wizard on the first startup. This resulted in multiple security-related...

CVE-2017-3158: Concurrent Execution using Shared Resource with Improper Synchronization

A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes could cause packet data to be misread as the packet length, resulting in the remaining data being written beyond the end o...

CVE-2018-5344: Concurrent Execution using Shared Resource with Improper Synchronization

In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lorelease serialization, which allows attackers to cause a denial of service lockacquire use-after-free or possibly have unspecified other impact...