Total
398478 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-35432 | 1 Cisa | 1 Thorium | 2026-06-17 | N/A | 5.3 MEDIUM |
| CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited messages to a user who is pending verification. Fixed in 1.1.1 by adding a rate limit set by default to 10 minutes. | |||||
| CVE-2025-35431 | 1 Cisa | 1 Thorium | 2026-06-17 | N/A | 5.4 MEDIUM |
| CISA Thorium does not escape user controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization data such as group memberships. Fixed in 1.1.1. | |||||
| CVE-2025-35430 | 1 Cisa | 1 Thorium | 2026-06-17 | N/A | 5.0 MEDIUM |
| CISA Thorium does not adequately validate the paths of downloaded files via 'download_ephemeral' and 'download_children'. A remote, authenticated attacker could access arbitrary files subject to file system permissions. Fixed in 1.1.2. | |||||
| CVE-2025-35115 | 1 Atlassian | 1 Agiloft | 2026-06-17 | N/A | 8.1 HIGH |
| Agiloft Release 28 downloads critical system packages over an insecure HTTP connection. An attacker in a Man-In-the-Middle position could replace or modify the contents of the download URL. Users should upgrade to Agiloft Release 30. | |||||
| CVE-2025-35114 | 1 Atlassian | 1 Agiloft | 2026-06-17 | N/A | 7.5 HIGH |
| Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The password hash is known for at least one of the accounts and the credentials could be cracked offline. Users should upgrade to Agiloft Release 30. | |||||
| CVE-2025-35113 | 1 Atlassian | 1 Agiloft | 2026-06-17 | N/A | 5.9 MEDIUM |
| Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achieve remote code execution by loading a specially crafted payload. Users should upgrade to Agiloft Release 31. | |||||
| CVE-2025-35112 | 1 Atlassian | 1 Agiloft | 2026-06-17 | N/A | 4.1 MEDIUM |
| Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an authenticated attacker to import the template file and perform path traversal on the local system files. Users should upgrade to Agiloft Release 31. | |||||
| CVE-2025-35062 | 1 Newforma | 1 Project Center | 2026-06-17 | N/A | 5.3 MEDIUM |
| Newforma Info Exchange (NIX) before version 2023.1 by default allows anonymous authentication which allows an unauthenticated attacker to exploit additional vulnerabilities that require authentication. | |||||
| CVE-2025-35061 | 1 Newforma | 1 Project Center | 2026-06-17 | N/A | 5.9 MEDIUM |
| Newforma Info Exchange (NIX) '/NPCSRemoteWeb/LegacyIntegrationServices.asmx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the user-configured NIX service account. | |||||
| CVE-2025-35060 | 1 Newforma | 1 Project Center | 2026-06-17 | N/A | 5.5 MEDIUM |
| Newforma Info Exchange (NIX) provides a 'Send a File Transfer' feature that allows a remote, authenticated attacker to upload SVG files that contain JavaScript or other content that may be executed or rendered by a web browser using a mobile user agent. | |||||
| CVE-2025-35059 | 1 Newforma | 1 Project Center | 2026-06-17 | N/A | 4.3 MEDIUM |
| Newforma Info Exchange (NIX) '/DownloadWeb/hyperlinkredirect.aspx' provides an unauthenticated URL redirect via the 'nhl' parameter. | |||||
| CVE-2025-35058 | 1 Newforma | 1 Project Center | 2026-06-17 | N/A | 5.9 MEDIUM |
| Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the customer-configured NIX service account. | |||||
| CVE-2025-35057 | 1 Newforma | 1 Project Center | 2026-06-17 | N/A | 5.3 MEDIUM |
| Newforma Info Exchange (NIX) '/RemoteWeb/IntegrationServices.ashx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the NIX service account. | |||||
| CVE-2025-35056 | 1 Newforma | 1 Project Center | 2026-06-17 | N/A | 5.0 MEDIUM |
| Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' 'StreamStampImage' accepts an encrypted file path and returns an image of the specified file. An authenticated attacker can read arbitrary files subject to the privileges of NIX, typically 'NT AUTHORITY\NetworkService', and the ability of StreamStampImage to process the file. The encrypted file path can be generated using the shared, hard-coded secret key described in CVE-2025-35052. This vulnerability cannot be exploited as an 'anonymous' user as described in CVE-2025-35062. | |||||
| CVE-2025-35055 | 1 Newforma | 1 Project Center | 2026-06-17 | N/A | 8.8 HIGH |
| Newforma Info Exchange (NIX) '/UserWeb/Common/UploadBlueimp.ashx' allows an authenticated attacker to upload an arbitrary file to any location writable by the NIX application. An attacker can upload and run a web shell or other content executable by the web server. An attacker can also delete directories. In Newforma before 2023.1, anonymous access is enabled by default (CVE-2025-35062), allowing an otherwise unauthenticated attacker to effectively authenticate as 'anonymous' and exploit this file upload vulnerability. | |||||
| CVE-2025-35054 | 1 Newforma | 1 Project Center | 2026-06-17 | N/A | 5.3 MEDIUM |
| Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\<version>\Credentials'. The credentials are encrypted but the encryption key is stored in the same registry location. Authenticated users can access both the credentials and the encryption key. If these are Active Directory credentials, an attacker may be able to gain access to additional systems and resources. | |||||
| CVE-2025-35053 | 1 Newforma | 1 Project Center | 2026-06-17 | N/A | 6.4 MEDIUM |
| Newforma Info Exchange (NIX) accepts requests to '/UserWeb/Common/MarkupServices.ashx' specifying the 'DownloadExportedPDF' command that allow an authenticated user to read and delete arbitrary files with 'NT AUTHORITY\NetworkService' privileges. In Newforma before 2023.1, anonymous access is enabled by default (CVE-2025-35062), allowing an otherwise unauthenticated attacker to effectively authenticate as 'anonymous' and exploit this file upload vulnerability. | |||||
| CVE-2025-35052 | 1 Newforma | 1 Project Center | 2026-06-17 | N/A | 5.3 MEDIUM |
| Newforma Info Exchange (NIX) uses a hard-coded key to encrypt certain query parameters. Some encrypted parameter values can specify paths to download files, potentially bypassing authentication and authorization, for example, the 'qs' parameter used in '/DownloadWeb/download.aspx'. This key is shared across NIX installations. NIX 2023.3 and 2024.1 limit the use of hard-coded keys. | |||||
| CVE-2025-35051 | 1 Newforma | 1 Project Center | 2026-06-17 | N/A | 9.8 CRITICAL |
| Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. According to the recommended architecture, the vulnerable NPCS endpoint is only accessible on an internal network. To mitigate this vulnerability, restrict network access to NPCS. | |||||
| CVE-2025-35050 | 1 Newforma | 1 Project Center | 2026-06-17 | N/A | 9.8 CRITICAL |
| Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. The vulnerable endpoint is used by Newforma Project Center Server (NPCS), so a compromised NIX system can be used to attack an associated NPCS system. To mitigate this vulnerability, restrict network access to the '/remoteweb/remote.rem' endpoint, for example using the IIS URL Rewrite Module. | |||||