Newforma records
14 published records for vendor newforma.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 3
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-294 Authentication Bypass by Capture-replay3
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')3
- CWE-306 Missing Authentication for Critical Function2
- CWE-276 Incorrect Default Permissions1
- CWE-257 Storing Passwords in a Recoverable Format1
- CWE-321 Use of Hard-coded Cryptographic Key1
The weakness classes this vendor ships most often: where to look.
CWEAll records
14 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
39Monitor | CVE-2024-32499No exploit | Newforma Project Center Server through 2023.3.0.32259 allows remote code execution because .NET Remoting is exposed.newforma · project center · CWE-94 | Critical9.8 | — | 0.4% | Apr 28, 2025 |
37Monitor | CVE-2025-35050No exploit | Newforma Info Exchange (NIX) .NET unauthenticated deserializationnewforma · project center · CWE-306 | Critical9.3 | — | 0.9% | Oct 9, 2025 |
36Monitor | CVE-2025-35051No exploit | Newforma Project Center Server (NPCS) .NET unauthenticated deserializationnewforma · project center · CWE-306 | Critical9.2 | — | 0.8% | Oct 9, 2025 |
34Monitor | CVE-2025-35055No exploit | Newforma Info Exchange (NIX) insecure file uploadnewforma · project center · CWE-22 | High8.7 | — | 0.5% | Oct 9, 2025 |
32Monitor | CVE-2025-35061No exploit | Newforma Info Exchange (NIX) forced NTLMv2 authentication via /NPCSRemoteWeb/LegacyIntegrationServices.asmxnewforma · project center · CWE-294 | High8.2 | — | 0.3% | Oct 9, 2025 |
32Monitor | CVE-2025-35058No exploit | Newforma Info Exchange (NIX) forced NTLMv2 authentication via /UserWeb/Common/MarkupServices.ashxnewforma · project center · CWE-294 | High8.2 | — | 0.3% | Oct 9, 2025 |
27Monitor | CVE-2025-35062No exploit | Newforma Info Exchange (NIX) default anonymous accessnewforma · project center · CWE-276 | Medium6.9 | — | 0.3% | Oct 9, 2025 |
25Monitor | CVE-2025-35052No exploit | Newforma Info Exchange (NIX) shared hard-coded secret keynewforma · project center · CWE-321 | Medium6.3 | — | 0.3% | Oct 9, 2025 |
24Monitor | CVE-2025-35053No exploit | Newforma Info Exchange (NIX) arbitrary file read and deletenewforma · project center · CWE-22 | Medium6.1 | — | 0.4% | Oct 9, 2025 |
24Monitor | CVE-2025-35057No exploit | Newforma Info Exchange (NIX) forced NTLMv2 authentication via /RemoteWeb/IntegrationServices.ashxnewforma · project center · CWE-294 | Medium6.0 | — | 0.3% | Oct 9, 2025 |
21Monitor | CVE-2025-35056No exploit | Newforma Info Exchange (NIX) limited file readnewforma · project center · CWE-22 | Medium5.3 | — | 0.3% | Oct 9, 2025 |
21Monitor | CVE-2025-35059No exploit | Newforma Info Exchange (NIX) open URL redirect via /DownloadWeb/hyperlinkredirect.aspxnewforma · project center · CWE-601 | Medium5.3 | — | 0.2% | Oct 9, 2025 |
20Monitor | CVE-2025-35060No exploit | Newforma Info Exchange (NIX) stored XSS via SVG file uploadnewforma · project center · CWE-79 | Medium5.1 | — | 0.2% | Oct 9, 2025 |
19Monitor | CVE-2025-35054No exploit | Newforma Info Exchange (NIX) insufficiently protected credentialsnewforma · project center · CWE-257 | Medium4.8 | — | 0.0% | Oct 9, 2025 |
- CVE-2024-3249939Monitor
Newforma Project Center Server through 2023.3.0.32259 allows remote code execution because .NET Remoting is exposed.
CriticalCVSS 9.8No exploitEPSS 0%newforma · project centerApr 28, 2025
- CVE-2025-3505037Monitor
Newforma Info Exchange (NIX) .NET unauthenticated deserialization
CriticalCVSS 9.3No exploitEPSS 0%newforma · project centerOct 9, 2025
- CVE-2025-3505136Monitor
Newforma Project Center Server (NPCS) .NET unauthenticated deserialization
CriticalCVSS 9.2No exploitEPSS 0%newforma · project centerOct 9, 2025
- CVE-2025-3505534Monitor
Newforma Info Exchange (NIX) insecure file upload
HighCVSS 8.7No exploitEPSS 0%newforma · project centerOct 9, 2025
- CVE-2025-3506132Monitor
Newforma Info Exchange (NIX) forced NTLMv2 authentication via /NPCSRemoteWeb/LegacyIntegrationServices.asmx
HighCVSS 8.2No exploitEPSS 0%newforma · project centerOct 9, 2025
- CVE-2025-3505832Monitor
Newforma Info Exchange (NIX) forced NTLMv2 authentication via /UserWeb/Common/MarkupServices.ashx
HighCVSS 8.2No exploitEPSS 0%newforma · project centerOct 9, 2025
- CVE-2025-3506227Monitor
Newforma Info Exchange (NIX) default anonymous access
MediumCVSS 6.9No exploitEPSS 0%newforma · project centerOct 9, 2025
- CVE-2025-3505225Monitor
Newforma Info Exchange (NIX) shared hard-coded secret key
MediumCVSS 6.3No exploitEPSS 0%newforma · project centerOct 9, 2025
- CVE-2025-3505324Monitor
Newforma Info Exchange (NIX) arbitrary file read and delete
MediumCVSS 6.1No exploitEPSS 0%newforma · project centerOct 9, 2025
- CVE-2025-3505724Monitor
Newforma Info Exchange (NIX) forced NTLMv2 authentication via /RemoteWeb/IntegrationServices.ashx
MediumCVSS 6.0No exploitEPSS 0%newforma · project centerOct 9, 2025
- CVE-2025-3505621Monitor
Newforma Info Exchange (NIX) limited file read
MediumCVSS 5.3No exploitEPSS 0%newforma · project centerOct 9, 2025
- CVE-2025-3505921Monitor
Newforma Info Exchange (NIX) open URL redirect via /DownloadWeb/hyperlinkredirect.aspx
MediumCVSS 5.3No exploitEPSS 0%newforma · project centerOct 9, 2025
- CVE-2025-3506020Monitor
Newforma Info Exchange (NIX) stored XSS via SVG file upload
MediumCVSS 5.1No exploitEPSS 0%newforma · project centerOct 9, 2025
- CVE-2025-3505419Monitor
Newforma Info Exchange (NIX) insufficiently protected credentials
MediumCVSS 4.8No exploitEPSS 0%newforma · project centerOct 9, 2025