Falhas do tipo CWE-524
92 resultadosArmazenamento de Informações Sensíveis em Cache
A aplicação armazena dados sensíveis (senhas, tokens, chaves, dados pessoais) em cache sem proteção adequada. Um atacante com acesso ao sistema de arquivos, memória ou cache compartilhado consegue recuperar essas informações, comprometendo contas e dados.
Exemplo
Um navegador cachea credenciais de login em texto plano no disco, ou uma API armazena tokens JWT no Redis compartilhado sem criptografia. Qualquer processo ou usuário com acesso ao cache extrai os dados sensíveis.
Como mitigar
Nunca cachear dados sensíveis, ou cacheá-los criptografados com chaves gerenciadas de forma segura. Use marcadores HTTP (Cache-Control: no-store, no-cache) e configure TTL agressivo. Limpe o cache ao fazer logout ou destruir sessões.
CVE-2026-35193LOWPotential exposure of private data via missing Vary: Authorization in UpdateCacheMiddlewareEPSS 0.4%CVE-2024-12314HIGHRapid Cache <= 1.2.3 - Unauthenticated Cache PoisoningEPSS 0.4%CVE-2026-6907LOWPotential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddlewareEPSS 0.4%CVE-2024-49580MEDIUMIn JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosureEPSS 0.4%CVE-2025-57752MEDIUMNext.js Affected by Cache Key Confusion for Image Optimization API RoutesEPSS 0.3%CVE-2026-94386MEDIUMApache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token CacheEPSS 0.3%CVE-2026-118489HIGHCachingWebClient shares user-specific HTTP responses across users via the shared cache tierEPSS 0.3%CVE-2026-41841MEDIUMSpring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFluxEPSS 0.3%CVE-2026-88059MEDIUMAngular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`EPSS 0.3%CVE-2026-64648MEDIUMNext.js: Response Body Cache Confusion for Requests Containing BodiesEPSS 0.3%CVE-2026-59903MEDIUMNetty: Cache Poisoning and Information Disclosure via CORS Vary Header OverwriteEPSS 0.3%CVE-2025-69202MEDIUMaxios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary HeaderEPSS 0.3%CVE-2026-49858MEDIUMAPI Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gateEPSS 0.3%CVE-2025-14806MEDIUMIBM Planning Analytics Information DisclosureEPSS 0.3%CVE-2026-84933MEDIUMundici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared cachesEPSS 0.3%CVE-2025-61598MEDIUMDiscourse is missing Cache-Control response header on error responsesEPSS 0.3%CVE-2026-120474MEDIUMundici vulnerable to cross-user cache disclosure via same-origin redirectEPSS 0.3%CVE-2026-0281LOWPAN-OS: Information Disclosure Vulnerability in Management Web InterfaceEPSS 0.3%CVE-2026-109217MEDIUMPDF Invoices & Packing Slips for WooCommerce <= 5.16.5 - Unauthenticated Sensitive Information Exposure via Yearly-Reset Invoice Attachment CacheEPSS 0.3%CVE-2026-104006LOWSpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie CheckEPSS 0.3%