Weaknesses of type CWE-525

39 results

Armazenamento de Informações Sensíveis no Cache do Navegador

O navegador cacheia automaticamente conteúdo HTTP para melhorar desempenho, incluindo páginas com dados sensíveis (senhas, tokens, CPF, dados bancários). Um atacante com acesso físico ou remoto ao dispositivo consegue recuperar essas informações do cache, comprometendo a privacidade e segurança do usuário.

Example

Um formulário de login retorna a senha do usuário no HTML da página sem headers HTTP apropriados. O navegador armazena a página em cache. Semanas depois, um atacante acessa o computador, abre o histórico ou a pasta de cache e recupera a senha em texto plano.

How to mitigate

Use headers HTTP como Cache-Control: no-store, no-cache e Pragma: no-cache em respostas contendo dados sensíveis. Implemente JavaScript para limpar o cache ao deslogar. Nunca envie senhas ou tokens críticos diretamente no HTML — use apenas em cookies seguros (HttpOnly, Secure, SameSite) ou memória volátil.

CVE-2026-13697HIGHundici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directivesEPSS 0.6%CVE-2025-48947HIGHNextJS-Auth0 SDK Vulnerable to CDN Caching of Session CookiesEPSS 0.4%CVE-2026-118550MEDIUMAI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270EPSS 0.3%CVE-2024-25142MEDIUMApache Airflow: Cache Control - Storage of Sensitive Data in Browser Cache EPSS 0.3%CVE-2024-23571MEDIUMHCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to whichEPSS 0.3%CVE-2024-30130LOWHCL Nomad server on Domino is affected by a use of web browser cache containing sensitive information vulnerabilityEPSS 0.3%CVE-2026-41322MEDIUM@astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformedEPSS 0.3%CVE-2025-13083LOWDrupal core - Moderately critical - Information disclosure - SA-CORE-2025-008EPSS 0.3%CVE-2024-45314LOWFlask-AppBuilder login form allows browser to cache sensitive fieldsEPSS 0.3%CVE-2026-27514HIGHTenda F3 Plaintext Credential Exposure in Configuration DownloadEPSS 0.3%CVE-2025-52625LOWHCL AION is susceptible to Cacheable SSL Page Found vulnerabilityEPSS 0.2%CVE-2026-87940MEDIUMKey auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138EPSS 0.2%CVE-2021-42015—A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.26), Mendix Applications using Mendix 8 (AllEPSS 0.2%CVE-2024-22343MEDIUMIBM TXSeries for Multiplatforms information disclosureEPSS 0.2%CVE-2024-22349MEDIUMIBM UrbanCode Velocity information disclosureEPSS 0.2%CVE-2026-96369LOWWebform - Less critical - Access bypass - SA-CONTRIB-2026-165EPSS 0.2%CVE-2026-114548LOWImageAPI Optimize WebP - Moderately critical - Information disclosure - SA-CONTRIB-2026-247EPSS 0.2%CVE-2026-118571MEDIUMMedia Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292EPSS 0.2%CVE-2026-114546LOWMedia Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-245EPSS 0.2%CVE-2023-27545MEDIUMIBM Watson CloudPak for Data Data Stores information disclosureEPSS 0.2%