Weaknesses of type CWE-524

72 results

Cache com Informações Sensíveis

A aplicação armazena dados sensíveis (senhas, tokens, PII) em cache sem proteção adequada, permitindo que um atacante com acesso ao sistema recupere essas informações. O risco é que o cache persista além da sessão ou seja acessível a outros usuários/processos.

Example

Um navegador cacheia credenciais de login em histórico ou localStorage sem criptografia; um servidor de aplicação mantém tokens JWT em cache em memória compartilhada; um browser salva respostas HTTP contendo dados pessoais em cache local onde outro usuário da máquina consegue ler.

How to mitigate

Nunca cachear dados sensíveis ou, se necessário, use criptografia forte e TTL (tempo de expiração) curto. Configure headers HTTP (Cache-Control: no-store, no-cache) para impedir cache de respostas com PII, e limpe cache na logout/fim de sessão. Em armazenamento local (localStorage/sessionStorage), evite sensíveis; use memória efêmera.

CVE-2026-59213LOWOpen WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)EPSS 0.3%CVE-2026-88059MEDIUMAngular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`EPSS 0.3%CVE-2025-14806MEDIUMIBM Planning Analytics Information DisclosureEPSS 0.3%CVE-2026-0281LOWPAN-OS: Information Disclosure Vulnerability in Management Web InterfaceEPSS 0.3%CVE-2025-61598MEDIUMDiscourse is missing Cache-Control response header on error responsesEPSS 0.3%CVE-2026-64792HIGHJoomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensionsEPSS 0.2%CVE-2026-84933MEDIUMundici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared cachesEPSS 0.2%CVE-2025-43410LOWThe issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.2EPSS 0.2%CVE-2024-33004MEDIUMInsecure Storage vulnerability in SAP BusinessObjects Business Intelligence Platform (Webservices)EPSS 0.2%CVE-2026-48901HIGHJoomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objectsEPSS 0.2%CVE-2026-59903MEDIUMNetty: Cache Poisoning and Information Disclosure via CORS Vary Header OverwriteEPSS 0.2%CVE-2026-65755HIGHJoomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extensionEPSS 0.2%CVE-2025-69581MEDIUMAn issue was discovered in Chamillo LMS 1.11.2. The Social Network /personal_data endpoint exposes full sensitive user information even afteEPSS 0.2%CVE-2026-22741LOWStatic resource cache poisoning in Spring MVC and WebFluxEPSS 0.2%CVE-2022-32909MEDIUMThe issue was addressed with improved handling of caches. This issue is fixed in iOS 16. An app may be able to access user-sensitive data.EPSS 0.2%CVE-2026-32244MEDIUMDiscourse: Cached outdated summaries can leak removed contentEPSS 0.2%CVE-2024-41906MEDIUMA vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application does not EPSS 0.2%CVE-2026-50169MEDIUMAngular Service Worker Policy-Bypass & Credential-Stripping VulnerabilitiesEPSS 0.2%CVE-2026-47225MEDIUMImproper Search Cache Isolation for Scoped Search API Keys in TypesenseEPSS 0.2%CVE-2026-25703HIGHPotential information leakage from manager /network/graph API in NeuVectorEPSS 0.2%