https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 18:28:51 +0000 https://cve.radiocsirt.org/vuln/cnvd-2025-25849 cnvd-2025-25849 https://cve.radiocsirt.org/vuln/cnvd-2025-25849 https://cve.radiocsirt.org/vuln/euvd-2026-254675 EUVD-2026-254675 https://cve.radiocsirt.org/vuln/euvd-2026-254675 https://cve.radiocsirt.org/vuln/fkie_cve-2025-35060 <p>Newforma Info Exchange (NIX) provides a &#39;Send a File Transfer&#39; feature that allows a remote, authenticated attacker to upload SVG files that contain JavaScript or other content that may be executed or rendered by a web browser using a mobile user agent.</p> <p>Newforma Info Exchange (NIX) provides a &#39;Send a File Transfer&#39; feature that allows a remote, authenticated attacker to upload SVG files that contain JavaScript or other content that may be executed or rendered by a web browser using a mobile user agent.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-35060 https://cve.radiocsirt.org/vuln/ghsa-h75v-vvch-93vf <p>Newforma Info Exchange (NIX) provides a &#39;Send a File Transfer&#39; feature that allows a remote, authenticated attacker to upload SVG files that contain JavaScript or other content that may be executed or rendered by a web browser using a mobile user agent.</p> <p>Newforma Info Exchange (NIX) provides a &#39;Send a File Transfer&#39; feature that allows a remote, authenticated attacker to upload SVG files that contain JavaScript or other content that may be executed or rendered by a web browser using a mobile user agent.</p> https://cve.radiocsirt.org/vuln/ghsa-h75v-vvch-93vf https://cve.radiocsirt.org/vuln/va-25-282-01 <p>Newforma Info Exchange (NIX) accepts serialized .NET data via the &#39;/remoteweb/remote.rem&#39; endpoint, allowing a remote, unauthenticated attacker to execute arbitrary code with &#39;NT AUTHORITY\NetworkService&#39; privileges. The vulnerable endpoint is used by Newforma Project Center Server (NPCS), so a compromised NIX system can be used to attack an associated NPCS system. To mitigate this vulnerability, restrict network access to the &#39;/remoteweb/remote.rem&#39; endpoint, for example using the IIS URL Rewrite Module. Newforma Project Center Server (NPCS) accepts serialized .NET data via the &#39;/ProjectCenter.rem&#39; endpoint on 9003/tcp, allowing a remote, unauthenticated attacker to execute arbitrary code with &#39;NT AUTHORITY\NetworkService&#39; privileges. According to the recommended architecture, the vulnerable NPCS endpoint is only accessible on an internal network. To mitigate this vulnerability, restrict network access to NPCS. Newforma Info Exchange (NIX) uses a hard-coded key to encrypt certain query parameters. Some encrypted parameter values can specify paths to download files, potentially bypassing authentication and authorization, for example, the &#39;qs&#39; parameter used in &#39;/DownloadWeb/download.aspx&#39;. This key is shared across NIX installations. NIX 2023.3 and 2024.1 limit the use of hard-coded keys. Newforma Info Exchange (NIX) accepts requests to &#39;/UserWeb/Common/MarkupServices.ashx&#39; specifying the &#39;DownloadExportedPDF&#39; command that allow an authenticated user to read and delete arbit…</p> <p>Newforma Info Exchange (NIX) accepts serialized .NET data via the &#39;/remoteweb/remote.rem&#39; endpoint, allowing a remote, unauthenticated attacker to execute arbitrary code with &#39;NT AUTHORITY\NetworkService&#39; privileges. The vulnerable endpoint is used by Newforma Project Center Server (NPCS), so a compromised NIX system can be used to attack an associated NPCS system. To mitigate this vulnerability, restrict network access to the &#39;/remoteweb/remote.rem&#39; endpoint, for example using the IIS URL Rewrite Module. Newforma Project Center Server (NPCS) accepts serialized .NET data via the &#39;/ProjectCenter.rem&#39; endpoint on 9003/tcp, allowing a remote, unauthenticated attacker to execute arbitrary code with &#39;NT AUTHORITY\NetworkService&#39; privileges. According to the recommended architecture, the vulnerable NPCS endpoint is only accessible on an internal network. To mitigate this vulnerability, restrict network access to NPCS. Newforma Info Exchange (NIX) uses a hard-coded key to encrypt certain query parameters. Some encrypted parameter values can specify paths to download files, potentially bypassing authentication and authorization, for example, the &#39;qs&#39; parameter used in &#39;/DownloadWeb/download.aspx&#39;. This key is shared across NIX installations. NIX 2023.3 and 2024.1 limit the use of hard-coded keys. Newforma Info Exchange (NIX) accepts requests to &#39;/UserWeb/Common/MarkupServices.ashx&#39; specifying the &#39;DownloadExportedPDF&#39; command that allow an authenticated user to read and delete arbit…</p> https://cve.radiocsirt.org/vuln/va-25-282-01