Skip to main content

Datacap CVE-2025-36026

| EUVDEUVD-2025-19436 MEDIUM
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute (CWE-614)
2025-06-28 psirt@us.ibm.com
Information Disclosure IBM Datacap Datacap Navigator
4.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

3
EUVD ID Assigned
Mar 16, 2026 - 01:05 euvd
EUVD-2025-19436
Analysis Generated
Mar 16, 2026 - 01:05 vuln.today
CVE Published
Jun 28, 2025 - 01:15 nvd
MEDIUM 4.3

DescriptionCVE.org

IBM Datacap 9.1.7, 9.1.8, and 9.1.9

does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.

AnalysisAI

CVE-2025-36026 is a security vulnerability (CVSS 4.3). Remediation should follow standard vulnerability management procedures.

Technical ContextAI

Vulnerability type not specified by vendor.

RemediationAI

Monitor vendor channels for patch availability.

More in Datacap

View all
CVE-2024-39736 CRITICAL
9.8 Jul 15

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to HTTP header injection, caused by improper v
CVE-2026-8636 HIGH
7.5 Jun 22

Sensitive-data disclosure in IBM Datacap and Datacap Navigator (versions 9.1.7, 9.1.8, 9.1.9) lets an attacker recover u
CVE-2024-39731 HIGH
7.5 Jul 15

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 uses weaker than expected cryptographic algorithms that coul
CVE-2024-39732 HIGH
7.5 Jul 14

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 temporarily stores data from different environments that cou
CVE-2026-8059 MEDIUM
6.1 Jun 22

Cross-site scripting in IBM Datacap and Datacap Navigator 9.1.7 through 9.1.9 allows unauthenticated remote attackers to
CVE-2024-39733 MEDIUM
5.5 Jul 14

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 stores user credentials in plain clear text which can be rea
CVE-2024-39730 MEDIUM
5.4 Jun 28

IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim.
CVE-2025-36027 MEDIUM
5.4 Jun 28

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By pe
CVE-2024-39735 MEDIUM
5.4 Jul 15

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting. Rated medium severity
CVE-2024-39728 MEDIUM
5.4 Jul 15

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to stored cross-site scripting. Rated medium s
CVE-2026-9610 MEDIUM
5.3 Jun 22

Forced browsing exposure in IBM Datacap and IBM Datacap Navigator 9.1.7 through 9.1.9 allows a highly privileged local u
CVE-2024-39741 MEDIUM
5.3 Jul 15

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to traverse directories on the

Same weakness CWE-614 – Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

View all
CVE-2020-27651 HIGH POC
8.1
CVE-2024-10718 HIGH POC
7.5
CVE-2022-4409 HIGH POC
7.5
CVE-2022-3174 HIGH POC
7.5
CVE-2021-3882 MEDIUM POC
6.8
CVE-2022-4683 MEDIUM POC
6.5
CVE-2024-47833 MEDIUM POC
6.3
CVE-2023-5866 MEDIUM POC
5.7

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2025-36026 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy