Vulnerability-Lookup

GHSA-XFPJ-Q55P-7H2M

Vulnerability from github – Published: 2026-06-22 18:34 – Updated: 2026-06-26 21:32

Details

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic keys from memory. Attacker can use the same keys to decrypt password, gain access to the application and access sensitive data in the database.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-8636"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-316"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-22T16:16:42Z",
    "severity": "MODERATE"
  },
  "details": "IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic keys from memory. Attacker can\u00a0use the same keys to decrypt password, gain access to the application and access sensitive\u00a0data in the database.",
  "id": "GHSA-xfpj-q55p-7h2m",
  "modified": "2026-06-26T21:32:06Z",
  "published": "2026-06-22T18:34:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8636"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7276609"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-8636 (GCVE-0-2026-8636)

Vulnerability from cvelistv5 – Published: 2026-06-22 14:16 – Updated: 2026-06-22 16:07

Title

Multiple Vulnerabilities in IBM Datacap

Summary

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-316 - Cleartext Storage of Sensitive Information in Memory

Assigner

ibm

References

1 reference

URL	Tags
https://www.ibm.com/support/pages/node/7276609	vendor-advisorypatch

Impacted products

2 products

Vendor	Product	Version
IBM	Datacap	Affected: 9.1.7 , ≤ 1.8.4 (semver) Affected: 9.1.8 Affected: 9.1.9 cpe:2.3:a:ibm:datacap:9.1.7:::::::* cpe:2.3:a:ibm:datacap:9.1.8:::::::* cpe:2.3:a:ibm:datacap:9.1.9:::::::*
IBM	Datacap Navigator	Affected: 9.1.7 , ≤ 8.2.1.0 (semver) Affected: 9.1.8 Affected: 9.1.9 cpe:2.3:a:ibm:datacap_navigator:9.1.7:::::::* cpe:2.3:a:ibm:datacap_navigator:9.1.8:::::::* cpe:2.3:a:ibm:datacap_navigator:9.1.9:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8636",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T16:07:01.577649Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T16:07:09.938Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:datacap:9.1.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:datacap:9.1.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:datacap:9.1.9:*:*:*:*:*:*:*"
          ],
          "product": "Datacap",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "1.8.4",
              "status": "affected",
              "version": "9.1.7",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "9.1.8"
            },
            {
              "status": "affected",
              "version": "9.1.9"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:datacap_navigator:9.1.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:datacap_navigator:9.1.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:datacap_navigator:9.1.9:*:*:*:*:*:*:*"
          ],
          "product": "Datacap Navigator",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "8.2.1.0",
              "status": "affected",
              "version": "9.1.7",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "9.1.8"
            },
            {
              "status": "affected",
              "version": "9.1.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic keys from memory. Attacker can\u0026nbsp;use the same keys to decrypt password, gain access to the application and access sensitive\u0026nbsp;data in the database.\u003c/p\u003e"
            }
          ],
          "value": "IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic keys from memory. Attacker can\u00a0use the same keys to decrypt password, gain access to the application and access sensitive\u00a0data in the database."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-316",
              "description": "CWE-316 Cleartext Storage of Sensitive Information in Memory",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T14:16:01.647Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7276609"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing \u003ca href=\"https://www.ibm.com/support/pages/ibm-datacap-version-919-interim-fix-008-readme-file\" rel=\"nofollow\"\u003eIBM Datacap 9.1.9 Interim Fix 008\u003c/a\u003e\u003c/p\u003e"
            }
          ],
          "value": "IBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing IBM Datacap 9.1.9 Interim Fix 008"
        }
      ],
      "title": "Multiple Vulnerabilities in IBM Datacap",
      "x_generator": {
        "engine": "ibm-cvegen"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-8636",
    "datePublished": "2026-06-22T14:16:01.647Z",
    "dateReserved": "2026-05-14T19:33:49.373Z",
    "dateUpdated": "2026-06-22T16:07:09.938Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-XFPJ-Q55P-7H2M

CVE-2026-8636 (GCVE-0-2026-8636)

Tags

Sightings

Nomenclature