535 matches found
CVE-2025-35057: Authentication Bypass by Capture-replay
Newforma Info Exchange NIX '/RemoteWeb/IntegrationServices.ashx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the NIX service account...
CVE-2025-35062: Incorrect Default Permissions
Newforma Info Exchange NIX before version 2023.1 by default allows anonymous authentication which allows an unauthenticated attacker to exploit additional vulnerabilities that require authentication...
CVE-2025-35061: Authentication Bypass by Capture-replay
Newforma Info Exchange NIX '/NPCSRemoteWeb/LegacyIntegrationServices.asmx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the user-configured NIX service account...
CVE-2025-35055: Improper Limitation of a Pathname to a Restricted Directory
Newforma Info Exchange NIX '/UserWeb/Common/UploadBlueimp.ashx' allows an authenticated attacker to upload an arbitrary file to any location writable by the NIX application. An attacker can upload and run a web shell or other content executable by the web server. An attacker can also delete...
Newforma Project Center Server 安全漏洞
Newforma Project Center Server is a project information management solution for the Architecture, Engineering and Construction AEC industry from Newforma for centralized storage and management of project documents and collaboration. An information disclosure vulnerability exists in Newforma Proje...
CVE-2025-35054: Insecure Storage of Sensitive Information
Newforma Info Exchange NIX stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\ \Credentials'. The credentials are encrypted but the encryption key is stored in the same registry location. Authenticated users can access both the credentials and the encryption key. If...
CVE-2025-35060: Improper Neutralization of Input During Web Page Generation
Newforma Info Exchange NIX provides a 'Send a File Transfer' feature that allows a remote, authenticated attacker to upload SVG files that contain JavaScript or other content that may be executed or rendered by a web browser using a mobile user agent...
CVE-2025-35059: URL Redirection to Untrusted Site
Newforma Info Exchange NIX '/DownloadWeb/hyperlinkredirect.aspx' provides an unauthenticated URL redirect via the 'nhl' parameter...
CVE-2025-35053: Improper Limitation of a Pathname to a Restricted Directory
Newforma Info Exchange NIX accepts requests to '/UserWeb/Common/MarkupServices.ashx' specifying the 'DownloadExportedPDF' command that allow an authenticated user to read and delete arbitrary files with 'NT AUTHORITY\NetworkService' privileges. In Newforma before 2023.1, anonymous access is enabl...
CVE-2025-35050: Deserialization of Untrusted Data
Newforma Info Exchange NIX accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. The vulnerable endpoint is used by Newforma Project Center Server NPCS, so a...
EUVD-2015-3282
Malware in sbrugna...
EUVD-2025-30534
Malicious code in bioql PyPI...
EUVD-2024-24524
Malicious code in bioql PyPI...
EUVD-2022-0497
Malicious code in bioql PyPI...
EUVD-2024-42296
Malicious code in bioql PyPI...
EUVD-2024-37395
Malicious code in bioql PyPI...
EUVD-2024-41529
Malicious code in bioql PyPI...
EUVD-2025-11469
Malicious code in bioql PyPI...