https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 15:59:28 +0000 https://cve.radiocsirt.org/vuln/cnvd-2025-25887 cnvd-2025-25887 https://cve.radiocsirt.org/vuln/cnvd-2025-25887 https://cve.radiocsirt.org/vuln/euvd-2026-254681 EUVD-2026-254681 https://cve.radiocsirt.org/vuln/euvd-2026-254681 https://cve.radiocsirt.org/vuln/fkie_cve-2025-35053 <p>Newforma Info Exchange (NIX) accepts requests to &#39;/UserWeb/Common/MarkupServices.ashx&#39; specifying the &#39;DownloadExportedPDF&#39; command that allow an authenticated user to read and delete arbitrary files with &#39;NT AUTHORITY\NetworkService&#39; privileges.</p> <p>In Newforma before 2023.1, anonymous access is enabled by default (CVE-2025-35062), allowing an otherwise unauthenticated attacker to effectively authenticate as &#39;anonymous&#39; and exploit this file upload vulnerability.</p> <p>Newforma Info Exchange (NIX) accepts requests to &#39;/UserWeb/Common/MarkupServices.ashx&#39; specifying the &#39;DownloadExportedPDF&#39; command that allow an authenticated user to read and delete arbitrary files with &#39;NT AUTHORITY\NetworkService&#39; privileges.</p> <p>In Newforma before 2023.1, anonymous access is enabled by default (CVE-2025-35062), allowing an otherwise unauthenticated attacker to effectively authenticate as &#39;anonymous&#39; and exploit this file upload vulnerability.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-35053 https://cve.radiocsirt.org/vuln/ghsa-22mx-5372-vwv3 <p>Newforma Info Exchange (NIX) accepts requests to &#39;/UserWeb/Common/MarkupServices.ashx&#39; specifying the &#39;DownloadExportedPDF&#39; command that allow an authenticated user to read and delete arbitrary files with &#39;NT AUTHORITY\NetworkService&#39; privileges.</p> <p>In Newforma before 2023.1, anonymous access is enabled by default (CVE-2025-35062), allowing an otherwise unauthenticated attacker to effectively authenticate as &#39;anonymous&#39; and exploit this file upload vulnerability.</p> <p>Newforma Info Exchange (NIX) accepts requests to &#39;/UserWeb/Common/MarkupServices.ashx&#39; specifying the &#39;DownloadExportedPDF&#39; command that allow an authenticated user to read and delete arbitrary files with &#39;NT AUTHORITY\NetworkService&#39; privileges.</p> <p>In Newforma before 2023.1, anonymous access is enabled by default (CVE-2025-35062), allowing an otherwise unauthenticated attacker to effectively authenticate as &#39;anonymous&#39; and exploit this file upload vulnerability.</p> https://cve.radiocsirt.org/vuln/ghsa-22mx-5372-vwv3 https://cve.radiocsirt.org/vuln/va-25-282-01 <p>Newforma Info Exchange (NIX) accepts serialized .NET data via the &#39;/remoteweb/remote.rem&#39; endpoint, allowing a remote, unauthenticated attacker to execute arbitrary code with &#39;NT AUTHORITY\NetworkService&#39; privileges. The vulnerable endpoint is used by Newforma Project Center Server (NPCS), so a compromised NIX system can be used to attack an associated NPCS system. To mitigate this vulnerability, restrict network access to the &#39;/remoteweb/remote.rem&#39; endpoint, for example using the IIS URL Rewrite Module. Newforma Project Center Server (NPCS) accepts serialized .NET data via the &#39;/ProjectCenter.rem&#39; endpoint on 9003/tcp, allowing a remote, unauthenticated attacker to execute arbitrary code with &#39;NT AUTHORITY\NetworkService&#39; privileges. According to the recommended architecture, the vulnerable NPCS endpoint is only accessible on an internal network. To mitigate this vulnerability, restrict network access to NPCS. Newforma Info Exchange (NIX) uses a hard-coded key to encrypt certain query parameters. Some encrypted parameter values can specify paths to download files, potentially bypassing authentication and authorization, for example, the &#39;qs&#39; parameter used in &#39;/DownloadWeb/download.aspx&#39;. This key is shared across NIX installations. NIX 2023.3 and 2024.1 limit the use of hard-coded keys. Newforma Info Exchange (NIX) accepts requests to &#39;/UserWeb/Common/MarkupServices.ashx&#39; specifying the &#39;DownloadExportedPDF&#39; command that allow an authenticated user to read and delete arbit…</p> <p>Newforma Info Exchange (NIX) accepts serialized .NET data via the &#39;/remoteweb/remote.rem&#39; endpoint, allowing a remote, unauthenticated attacker to execute arbitrary code with &#39;NT AUTHORITY\NetworkService&#39; privileges. The vulnerable endpoint is used by Newforma Project Center Server (NPCS), so a compromised NIX system can be used to attack an associated NPCS system. To mitigate this vulnerability, restrict network access to the &#39;/remoteweb/remote.rem&#39; endpoint, for example using the IIS URL Rewrite Module. Newforma Project Center Server (NPCS) accepts serialized .NET data via the &#39;/ProjectCenter.rem&#39; endpoint on 9003/tcp, allowing a remote, unauthenticated attacker to execute arbitrary code with &#39;NT AUTHORITY\NetworkService&#39; privileges. According to the recommended architecture, the vulnerable NPCS endpoint is only accessible on an internal network. To mitigate this vulnerability, restrict network access to NPCS. Newforma Info Exchange (NIX) uses a hard-coded key to encrypt certain query parameters. Some encrypted parameter values can specify paths to download files, potentially bypassing authentication and authorization, for example, the &#39;qs&#39; parameter used in &#39;/DownloadWeb/download.aspx&#39;. This key is shared across NIX installations. NIX 2023.3 and 2024.1 limit the use of hard-coded keys. Newforma Info Exchange (NIX) accepts requests to &#39;/UserWeb/Common/MarkupServices.ashx&#39; specifying the &#39;DownloadExportedPDF&#39; command that allow an authenticated user to read and delete arbit…</p> https://cve.radiocsirt.org/vuln/va-25-282-01