CVE-2026-9610: Direct Request

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 exposes resources or functionality that isn't linked in the UI but is accessible by directly requesting the URL, bypassing intended access controls...

CVE-2026-8636: Cleartext Storage of Sensitive Information in Memory

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic keys from memory. Attacker can use the same keys to decrypt password, gain access to the application and access sensitive data in the database...

CVE-2026-8059: Improper Neutralization of Input During Web Page Generation

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2024-39728

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sessio...

CVE-2024-39737

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 296004...

CVE-2024-39733

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 295972...

CVE-2024-39730

IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attack...

CVE-2024-39734

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent...

CVE-2024-39736

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or...

EUVD-2024-38220

Malicious code in bioql PyPI...

EUVD-2024-38217

Malicious code in bioql PyPI...

EUVD-2024-38210

Malicious code in bioql PyPI...

EUVD-2024-38219

Malicious code in bioql PyPI...

EUVD-2024-38216

Malicious code in bioql PyPI...

EUVD-2024-38214

Malicious code in bioql PyPI...

EUVD-2024-54714

Malicious code in bioql PyPI...

EUVD-2024-38218

Malicious code in bioql PyPI...

EUVD-2024-38209

Malicious code in bioql PyPI...

EUVD-2024-38212

Malicious code in bioql PyPI...

The vulnerability in the web client of IBM Datacap Navigator software, which is used for collecting and processing documents with IBM Datacap, allows a perpetrator to carry out a clickjacking attack.

The vulnerability in the IBM Datacap Navigator software, a document collection and processing tool, relates to an improper limitation on the visible layers of the user interface. Exploiting this vulnerability could allow a malicious actor to carry out a clickjacking attack remotely...