Weaknesses of type CWE-524

92 results

Cache com Informações Sensíveis

A aplicação armazena dados sensíveis (senhas, tokens, PII) em cache sem proteção adequada, permitindo que um atacante com acesso ao sistema recupere essas informações. O risco é que o cache persista além da sessão ou seja acessível a outros usuários/processos.

Example

Um navegador cacheia credenciais de login em histórico ou localStorage sem criptografia; um servidor de aplicação mantém tokens JWT em cache em memória compartilhada; um browser salva respostas HTTP contendo dados pessoais em cache local onde outro usuário da máquina consegue ler.

How to mitigate

Nunca cachear dados sensíveis ou, se necessário, use criptografia forte e TTL (tempo de expiração) curto. Configure headers HTTP (Cache-Control: no-store, no-cache) para impedir cache de respostas com PII, e limpe cache na logout/fim de sessão. Em armazenamento local (localStorage/sessionStorage), evite sensíveis; use memória efêmera.

CVE-2026-103004MEDIUMnext.js cache leak on warm `use cache` handlers accessing root paramEPSS 0.3%CVE-2026-48901HIGHJoomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objectsEPSS 0.2%CVE-2025-43410LOWThe issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.2EPSS 0.2%CVE-2024-33004MEDIUMInsecure Storage vulnerability in SAP BusinessObjects Business Intelligence Platform (Webservices)EPSS 0.2%CVE-2026-94484MEDIUMNext.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of serviceEPSS 0.2%CVE-2022-32909MEDIUMThe issue was addressed with improved handling of caches. This issue is fixed in iOS 16. An app may be able to access user-sensitive data.EPSS 0.2%CVE-2025-69581MEDIUMAn issue was discovered in Chamillo LMS 1.11.2. The Social Network /personal_data endpoint exposes full sensitive user information even afteEPSS 0.2%CVE-2026-22741LOWStatic resource cache poisoning in Spring MVC and WebFluxEPSS 0.2%CVE-2023-37517LOWHCL Domino Volt and Domino Leap are affected by missing "no cache" headersEPSS 0.2%CVE-2024-41906MEDIUMA vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application does not EPSS 0.2%CVE-2026-32244MEDIUMDiscourse: Cached outdated summaries can leak removed contentEPSS 0.2%CVE-2025-65681LOWAn issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to seEPSS 0.2%CVE-2026-50169MEDIUMAngular Service Worker Policy-Bypass & Credential-Stripping VulnerabilitiesEPSS 0.2%CVE-2026-19202CRITICALToken Cache Reuse in mcp-toolbox-sdk-pythonEPSS 0.2%CVE-2026-47225MEDIUMImproper Search Cache Isolation for Scoped Search API Keys in TypesenseEPSS 0.2%CVE-2026-105711LOWUse of Cache Containing Sensitive Information in GitLabEPSS 0.2%CVE-2026-105752LOWvLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracleEPSS 0.2%CVE-2026-50184MEDIUMAngular: Request Credential & Cache Policy Stripping in Angular Service WorkerEPSS 0.2%CVE-2026-44457MEDIUMHono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakageEPSS 0.2%CVE-2026-107851MEDIUMContao: Improper access control in the table access voterEPSS 0.2%