Fallos del tipo CWE-524

92 resultados

Armazenamento de Informações Sensíveis em Cache

Ocorre quando dados sensíveis (senhas, tokens, chaves de API, dados pessoais) são armazenados em cache sem proteção adequada. Um atacante com acesso ao cache consegue recuperar essas informações comprometendo a segurança da aplicação.

Ejemplo

Um navegador ou aplicativo armazena em cache uma resposta HTTP contendo token de autenticação ou dados de cartão de crédito. Se o cache não for criptografado e o dispositivo for comprometido, o atacante extrai essas credenciais diretamente dos arquivos de cache.

Cómo mitigar

Marque respostas com dados sensíveis como não-cacheáveis (Cache-Control: no-store, no-cache), use criptografia para dados em cache e implemente limpeza automática de cache após logout ou timeout. Nunca armazene credenciais em cache localmente sem encriptação.

CVE-2026-35193LOWPotential exposure of private data via missing Vary: Authorization in UpdateCacheMiddlewareEPSS 0.4%CVE-2024-12314HIGHRapid Cache <= 1.2.3 - Unauthenticated Cache PoisoningEPSS 0.4%CVE-2026-6907LOWPotential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddlewareEPSS 0.4%CVE-2024-49580MEDIUMIn JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosureEPSS 0.4%CVE-2025-57752MEDIUMNext.js Affected by Cache Key Confusion for Image Optimization API RoutesEPSS 0.3%CVE-2026-94386MEDIUMApache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token CacheEPSS 0.3%CVE-2026-118489HIGHCachingWebClient shares user-specific HTTP responses across users via the shared cache tierEPSS 0.3%CVE-2026-41841MEDIUMSpring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFluxEPSS 0.3%CVE-2026-88059MEDIUMAngular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`EPSS 0.3%CVE-2026-64648MEDIUMNext.js: Response Body Cache Confusion for Requests Containing BodiesEPSS 0.3%CVE-2026-59903MEDIUMNetty: Cache Poisoning and Information Disclosure via CORS Vary Header OverwriteEPSS 0.3%CVE-2025-69202MEDIUMaxios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary HeaderEPSS 0.3%CVE-2026-49858MEDIUMAPI Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gateEPSS 0.3%CVE-2025-14806MEDIUMIBM Planning Analytics Information DisclosureEPSS 0.3%CVE-2026-84933MEDIUMundici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared cachesEPSS 0.3%CVE-2025-61598MEDIUMDiscourse is missing Cache-Control response header on error responsesEPSS 0.3%CVE-2026-120474MEDIUMundici vulnerable to cross-user cache disclosure via same-origin redirectEPSS 0.3%CVE-2026-0281LOWPAN-OS: Information Disclosure Vulnerability in Management Web InterfaceEPSS 0.3%CVE-2026-109217MEDIUMPDF Invoices & Packing Slips for WooCommerce <= 5.16.5 - Unauthenticated Sensitive Information Exposure via Yearly-Reset Invoice Attachment CacheEPSS 0.3%CVE-2026-104006LOWSpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie CheckEPSS 0.3%