Advisories · Weakness
CWE-524.
Every Advisory and CVE whose sources give the weakness CWE-524, newest first.
- CVSS 3.1 Low
Umbraco.Forms CDN may cache sensitive form uploads when processed by ImageSharp
- CWE-524
<13.9.0 || >=14.0.0-beta001, <16.4.0 || >=17.0.0-rc1, <17.1.0 · fixed in 13.9.0, 16.4.0, 17.1.0
GHSA-7jxj-rpx7-ph2c - CVSS 5.5 Medium
An issue was discovered in Chamillo LMS 1.11.2.
- CWE-524
- CVSS 6.0 Medium
axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header
- Broken access control
- CWE-524
<1.11.1 · fixed in 1.11.1
GHSA-x4m5-4cw8-vc44 · CVE-2025-69202 - CVSS 2.4 Low
The issue was addressed with improved handling of caches.
- Apple macOS
- CWE-524
- CVSS 4.8 Medium
Brother Industries, Ltd. Android App "Brother iPrint&Scan": Android App "Brother iPrint&Scan" versions 6.13.7 and earlier improperly uses an external…
- Brother Industries, Ltd. Android App "Brother iPrint&Scan"
- CWE-524
- CVSS 3.3 Low
An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-co...
- Authentication bypass
- CWE-524
<=20.0.2 · no fixed version yet
GHSA-gq25-78jf-v78c · CVE-2025-65681 - CVSS 8.0 High
authkit-nextjs may let session cookies be cached in CDNs
- CWE-524
<2.11.1 · fixed in 2.11.1
GHSA-p8pf-44ff-93gf · CVE-2025-64762 - CVSS 6.3 Medium
Discourse is missing Cache-Control response header on error responses
- discourse
- CWE-524
- CVSS 5.9 Medium
Libsoup: improper handling of http vary header in libsoup caching
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- CWE-524
- CVSS 6.2 Medium
Next.js Affected by Cache Key Confusion for Image Optimization API Routes
- CWE-524
>=0.9.9, <14.2.31 || >=15.0.0, <15.4.5 · fixed in 14.2.31, 15.4.5
GHSA-g5qg-72qw-gw5v · CVE-2025-57752 - CVSS 5.5 Medium
Core Privileged Access Manager (BoKS) Leakage of Sensitive Data via the Cache
- Fortra Core Privileged Access Manager (BoKS)
- CWE-524
- CVSS 5.1 Medium
Prisma Access Browser: Inappropriate implementation in Cache
- Palo Alto Networks Prisma Access Browser
- CWE-524
- CVSS 3.2 Low
HCL Domino Volt and Domino Leap are affected by missing "no cache" headers
- HCL Software HCL Domino Leap
- CWE-524
- CVSS 3.2 Low
HCL Leap is affected by missing "no cache" headers
- HCL Software HCL Leap
- CWE-524
- CVSS 3.2 Low
HCL Leap is affected by missing "no cache" headers
- HCL Software HCL Leap
- CWE-524
- CVSS 7.2 High
Rapid Cache <= 1.2.3 - Unauthenticated Cache Poisoning
- megaoptim Rapid Cache
- CWE-524
- CVSS 5.3 Medium
JetBrains Ktor information disclosure
- CWE-524
<2.3.13 · fixed in 2.3.13
GHSA-8qv4-773j-c979 · CVE-2024-49580 - CVSS 7.4 High
Session is cached for OpenID and OAuth2 if `redirect` is not used
- Authentication bypass
- CWE-524
<10.13.3 || >=11.0.0-rc.1, <11.1.0 · fixed in 10.13.3, 11.1.0
GHSA-cff8-x7jv-4fm8 · CVE-2024-45596 - CVSS 6.3 Medium
Siemens SINEC Traffic Analyzer: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All…
- Siemens SINEC Traffic Analyzer
- CWE-524
- CVSS 4.3 Medium
Insecure Storage vulnerability in SAP BusinessObjects Business Intelligence Platform (Webservices)
- SAP_SE SAP BusinessObjects Business Intelligence Platform (Webservices)
- Information disclosure
- CWE-524
- CVSS 5.3 Medium
CoreDNS may return invalid cache entries
- CWE-524
<1.11.2 · fixed in 1.11.2
GHSA-m9w6-wp3h-vq8g · CVE-2024-0874 - CVSS 7.5 High
Shopware's session is persistent in Cache for 404 pages
- CWE-524
>=6.5.8.0, <6.5.8.7 · fixed in 6.5.8.7
GHSA-c2f9-4jmm-v45m · CVE-2024-27917 - CVSS 4.0 Medium
HCL Sametime is impacted by an autocomplete enabled vulnerability
- HCL Software HCL Sametime
- CWE-524
- CVSS 5.9 Medium
Information Disclosure vulnerability in SAP Commerce (OCC API)
- SAP_SE SAP Commerce (OCC API)
- CWE-524
- CVSS 5.3 Medium
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1.
- CWE-524
-
Batched HTTP requests may set incorrect `cache-control` response header
- CWE-524
<4.1.0 · fixed in 4.1.0
GHSA-8r69-3cvp-wxc3 - CVSS 5.5 Medium
The issue was addressed with improved handling of caches.
- Apple iOS
- CWE-524
- CVSS 4.3 Medium
Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8.
- CWE-524
<2.4.8 · fixed in 2.4.8
GHSA-7fqm-jm52-f9vc · CVE-2022-3292 - CVSS 3.3 Low
Kubernetes Unsafe Cacheing
- Broken access control
- CWE-524
>=1.8.0, <1.12.9 · fixed in 1.12.9
GHSA-2575-pghm-6qqx · CVE-2019-11244 -
Facebook WhatsApp Business for Android: A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp…
- Facebook WhatsApp Business for Android
- Facebook WhatsApp for Android
- CWE-524
-
Atlassian Jira: The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers…
- Atlassian Jira
- CWE-524
-
The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns
- Wi-Fi Alliance hostapd with EAP-pwd support
- Wi-Fi Alliance wpa_supplicant with EAP-pwd support
- CWE-524
-
The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side-channel attacks
- Wi-Fi Alliance hostapd with SAE support
- Wi-Fi Alliance wpa_supplicant with SAE support
- CWE-208
- CWE-524