Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Newforma Project Center 2024.1 Clear all filters
TI-2025-24578 CVE-2025-35060 · GHSA-h75v-vvch-93vf

Newforma Info Exchange (NIX) stored XSS via SVG file upload

Priority LOW 23

Newforma Info Exchange (NIX) provides a 'Send a File Transfer' feature that allows a remote, authenticated attacker to upload SVG files that contain JavaScript or other content that may be executed or rendered by a web b…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.0022 Published 2025-10-09 Fixed in 2024.1 CWE-79
TI-2025-24574 CVE-2025-35056 · GHSA-7cq8-vqmc-75p3

Newforma Info Exchange (NIX) limited file read

Priority LOW 24

Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' 'StreamStampImage' accepts an encrypted file path and returns an image of the specified file.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00362 Published 2025-10-09 Fixed in 2024.1 CWE-22