Weaknesses of type CWE-525

31 results

Armazenamento de Informações Sensíveis no Cache do Navegador

O navegador cacheia automaticamente conteúdo HTTP para melhorar desempenho, incluindo páginas com dados sensíveis (senhas, tokens, CPF, dados bancários). Um atacante com acesso físico ou remoto ao dispositivo consegue recuperar essas informações do cache, comprometendo a privacidade e segurança do usuário.

Example

Um formulário de login retorna a senha do usuário no HTML da página sem headers HTTP apropriados. O navegador armazena a página em cache. Semanas depois, um atacante acessa o computador, abre o histórico ou a pasta de cache e recupera a senha em texto plano.

How to mitigate

Use headers HTTP como Cache-Control: no-store, no-cache e Pragma: no-cache em respostas contendo dados sensíveis. Implemente JavaScript para limpar o cache ao deslogar. Nunca envie senhas ou tokens críticos diretamente no HTML — use apenas em cookies seguros (HttpOnly, Secure, SameSite) ou memória volátil.

CVE-2025-48947HIGHNextJS-Auth0 SDK Vulnerable to CDN Caching of Session CookiesEPSS 0.4%CVE-2026-13697HIGHundici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directivesEPSS 0.3%CVE-2024-25142MEDIUMApache Airflow: Cache Control - Storage of Sensitive Data in Browser Cache EPSS 0.3%CVE-2024-30130LOWHCL Nomad server on Domino is affected by a use of web browser cache containing sensitive information vulnerabilityEPSS 0.3%CVE-2025-13083LOWDrupal core - Moderately critical - Information disclosure - SA-CORE-2025-008EPSS 0.3%CVE-2024-45314LOWFlask-AppBuilder login form allows browser to cache sensitive fieldsEPSS 0.3%CVE-2026-41322MEDIUM@astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformedEPSS 0.2%CVE-2025-52625LOWHCL AION is susceptible to Cacheable SSL Page Found vulnerabilityEPSS 0.2%CVE-2021-42015—A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.26), Mendix Applications using Mendix 8 (AllEPSS 0.2%CVE-2024-22343MEDIUMIBM TXSeries for Multiplatforms information disclosureEPSS 0.2%CVE-2026-27514HIGHTenda F3 Plaintext Credential Exposure in Configuration DownloadEPSS 0.2%CVE-2024-22349MEDIUMIBM UrbanCode Velocity information disclosureEPSS 0.2%CVE-2023-27545MEDIUMIBM Watson CloudPak for Data Data Stores information disclosureEPSS 0.2%CVE-2026-41918MEDIUMA vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V4.0). The affected applications stores sensitive EPSS 0.2%CVE-2024-31906MEDIUMIBM Automation Decision Services information disclosureEPSS 0.2%CVE-2023-46181MEDIUMIBM Secure Proxy information disclosureEPSS 0.2%CVE-2024-22333LOWIBM Maximo Application Suite information disclosureEPSS 0.2%CVE-2023-23469MEDIUMIBM Cloud Pak for Business Automation information disclosureEPSS 0.2%CVE-2024-23571MEDIUMHCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to whichEPSS 0.2%CVE-2022-38383MEDIUMIBM Cloud Pak for Security information disclosureEPSS 0.2%