Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-35005 State: PUBLISHED Published: 2025-06-08T21:05:15.936Z Last Updated: 2025-06-09T03:20:54.997Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Microhard Products: IPn4Gii / Bullet-LTE Firmware Problem Types: CWE-88 Description: Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFMAC command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been gen
Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://takeonme.org/cves/cve-2025-35005/ - https://www.microhardcorp.com/BulletLTE-NA2.php - https://www.microhardcorp.com/IPn4Gii-NA2.php - https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware
CVE ID: CVE-2025-35006 State: PUBLISHED Published: 2025-06-08T21:05:25.706Z Last Updated: 2025-06-09T03:19:46.712Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Microhard Products: IPn4Gii / Bullet-LTE Firmware Problem Types: CWE-88 Description: Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFPORTFWD command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been
ent Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://takeonme.org/cves/cve-2025-35006/ - https://www.microhardcorp.com/BulletLTE-NA2.php - https://www.microhardcorp.com/IPn4Gii-NA2.php - https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware
CVE ID: CVE-2025-35007 State: PUBLISHED Published: 2025-06-08T21:05:38.698Z Last Updated: 2025-06-09T03:18:53.105Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Microhard Products: IPn4Gii / Bullet-LTE Firmware Problem Types: CWE-88 Description: Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFRULE command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been ge
Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://takeonme.org/cves/cve-2025-35007/ - https://www.microhardcorp.com/BulletLTE-NA2.php - https://www.microhardcorp.com/IPn4Gii-NA2.php - https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware
CVE ID: CVE-2025-35008 State: PUBLISHED Published: 2025-06-08T21:05:52.090Z Last Updated: 2025-06-09T03:18:02.029Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Microhard Products: IPn4Gii / Bullet-LTE Firmware Problem Types: CWE-88 Description: Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been ge
Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://takeonme.org/cves/cve-2025-35008/ - https://www.microhardcorp.com/BulletLTE-NA2.php - https://www.microhardcorp.com/IPn4Gii-NA2.php - https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware
CVE ID: CVE-2025-35009 State: PUBLISHED Published: 2025-06-08T21:06:05.426Z Last Updated: 2025-06-09T03:17:10.831Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Microhard Products: IPn4Gii / Bullet-LTE Firmware Problem Types: CWE-88 Description: Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNNETSP command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been g
t Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://takeonme.org/cves/cve-2025-35009/ - https://www.microhardcorp.com/BulletLTE-NA2.php - https://www.microhardcorp.com/IPn4Gii-NA2.php - https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware
CVE ID: CVE-2025-35010 State: PUBLISHED Published: 2025-06-08T21:06:16.368Z Last Updated: 2025-06-09T03:16:04.477Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Microhard Products: IPn4Gii / Bullet-LTE Firmware Problem Types: CWE-88 Description: Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNPINGTM command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been
nt Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://takeonme.org/cves/cve-2025-35010/ - https://www.microhardcorp.com/BulletLTE-NA2.php - https://www.microhardcorp.com/IPn4Gii-NA2.php - https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware
CVE ID: CVE-2025-35021 State: PUBLISHED Published: 2025-11-04T00:23:23.924Z Last Updated: 2025-11-05T14:54:15.000Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Abilis Products: CPX Problem Types: CWE-1188 Description: By failing to authenticate three times to an unconfigured Abilis CPX device via SSH, an attacker can login to a restricted shell on the fourth attempt, and from there, relay connections. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.runzero.com/advisories/abilis-cpx-authentication-bypass-cve-2025-35021/ - https://takeonme.org/gcves/GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111111111011
025-35021/ - https://takeonme.org/gcves/GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111111111011111111110000000000000000000000000000000000000000000000000000000100 - https://support.abilis.net/relnotes/cpx2k/R9.0.html#R9.0.7
CVE ID: CVE-2025-35027 State: PUBLISHED Published: 2025-09-26T06:53:49.585Z Last Updated: 2025-10-07T21:10:12.489Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Unitree Products: Go2, G1 Problem Types: CWE-78 Description: Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting a malicious string when configuring the on-board WiFi via a BLE module of an affected robot, then triggering a restart of the WiFi service, an attacker can ultimately trigger commands to be run as root via the wpa_supplicant_restart.sh shell script. All Unitree models use firmware d
ely trigger commands to be run as root via the wpa_supplicant_restart.sh shell script. All Unitree models use firmware derived from the same codebase (MIT Cheetah), and the two major forks are the G1 (humanoid) and Go2 (quadruped) branches. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://takeonme.org/cves/cve-2025-35027 - https://github.com/Bin4ry/UniPwn - https://spectrum.ieee.org/unitree-robot-exploit - https://x.com/committeeonccp/status/1971250635548033311 - https://www.cve.org/cverecord?id=CVE-2025-60017 - https://www.cve.org/cverecord?id=CVE-2025-60250
CVE ID: CVE-2025-35029 State: PUBLISHED Published: 2025-11-20T19:34:31.465Z Last Updated: 2025-11-20T19:34:31.465Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Medical Informatics Engineering Products: Enterprise Health Problem Types: CWE-79 Description: Medical Informatics Engineering Enterprise Health has a stored cross site scripting vulnerability that allows an authenticated attacker to add arbitrary content in the 'Demographic Information' page. This content will be rendered and executed when a victim accesses it. This issue is fixed as of 2025-03-14. References: - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272
s of 2025-03-14. References: - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.json - https://www.cve.org/CVERecord?id=CVE-2025-35029
CVE ID: CVE-2025-35030 State: PUBLISHED Published: 2025-09-29T20:00:16.950Z Last Updated: 2025-09-30T16:50:38.126Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Medical Informatics Engineering Products: Enterprise Health Problem Types: CWE-352 Description: Medical Informatics Engineering Enterprise Health has a cross site request forgery vulnerability that allows an unauthenticated attacker to trick administrative users into clicking a crafted URL and perform actions on behalf of that administrative user. This issue is fixed as of 2025-04-08. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/cisagov/CSAF/devel
8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.json - https://www.cve.org/CVERecord?id=CVE-2025-35030
CVE ID: CVE-2025-35031 State: PUBLISHED Published: 2025-09-29T20:00:42.546Z Last Updated: 2025-09-30T16:51:17.132Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Medical Informatics Engineering Products: Enterprise Health Problem Types: CWE-1295 Description: Medical Informatics Engineering Enterprise Health includes the user's current session token in debug output. An attacker could convince a user to send this output to the attacker, thus allowing the attacker to impersonate that user. This issue is fixed as of 2025-04-08. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/whit
Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.json - https://www.cve.org/CVERecord?id=CVE-2025-35031
CVE ID: CVE-2025-35032 State: PUBLISHED Published: 2025-09-29T20:01:09.311Z Last Updated: 2025-09-30T16:51:39.465Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N) Vendors: Medical Informatics Engineering Products: Enterprise Health Problem Types: CWE-434 Description: Medical Informatics Engineering Enterprise Health allows authenticated users to upload arbitrary files. The impact of this behavior depends on how files are accessed. This issue is fixed as of 2025-04-08. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.json - https://www.cve.org/CVERecord?id=CVE-202
ercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.json - https://www.cve.org/CVERecord?id=CVE-2025-35032
CVE ID: CVE-2025-35033 State: PUBLISHED Published: 2025-09-29T20:01:38.144Z Last Updated: 2025-09-30T16:52:03.135Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: Medical Informatics Engineering Products: Enterprise Health Problem Types: CWE-1236 Description: Medical Informatics Engineering Enterprise Health has a CSV injection vulnerability that allows a remote, authenticated attacker to inject macros in downloadable CSV files. This issue is fixed as of 2025-03-14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.json - https://www.cve.org/CVERecord?
w.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.json - https://www.cve.org/CVERecord?id=CVE-2025-35033
CVE ID: CVE-2025-35034 State: PUBLISHED Published: 2025-09-29T20:01:58.419Z Last Updated: 2025-09-30T16:52:32.033Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Medical Informatics Engineering Products: Enterprise Health Problem Types: CWE-79 Description: Medical Informatics Engineering Enterprise Health has a reflected cross site scripting vulnerability in the 'portlet_user_id' URL parameter. A remote, unauthenticated attacker can craft a URL that can execute arbitrary JavaScript in the victim's browser. This issue is fixed as of 2025-03-14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/cisagov/CSAF/dev
-14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.json - https://www.cve.org/CVERecord?id=CVE-2025-35034
CVE ID: CVE-2025-35036 State: PUBLISHED Published: 2025-06-03T19:27:42.900Z Last Updated: 2025-06-05T18:41:26.981Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Hibernate Products: Hibernate Validator Problem Types: CWE-94 Description: Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not a
7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hibernate.org/validator/documentation/migration-guide/#6-2-0-cr1 - https://in.relation.to/2021/01/06/hibernate-validator-700-62-final-released/#expression-language - https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#section-hibernateconstraintvalidatorcontext - http
ocs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#section-hibernateconstraintvalidatorcontext - https://hibernate.atlassian.net/browse/HV-1816 - https://github.com/hibernate/hibernate-validator/compare/6.1.7.Final...6.2.0.Final - https://github.com/hibernate/hibernate-validator/commit/05f795bb7cf18856004f40e5042709e550ed0d6e - https://github.com/hibernate/hibernate-validator/commit/254858d9dcc4e7cd775d1b0f47f482218077c5e1 - https://github.com/hibernate/hibernate-validator/commit/e076293b0ee1bfa97b6e67d05ad9eee1ad77e893 - https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/ - https://github.com/hibernate/hibernate-validator/commit/d2d
sion-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/ - https://github.com/hibernate/hibernate-validator/commit/d2db40b9e7d22c7a0b44d7665242dfc7b4d14d78 - https://github.com/hibernate/hibernate-validator/pull/1138 - https://www.cve.org/CVERecord?id=CVE-2025-4428 - https://www.cve.org/CVERecord?id=CVE-2020-5245
CVE ID: CVE-2025-35041 State: PUBLISHED Published: 2025-09-22T15:56:38.084Z Last Updated: 2025-09-30T16:46:22.643Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Airship AI Products: Acropolis Problem Types: CWE-307 Description: Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials could brute-force the 6-digit MFA code. Fixed in 10.2.35, 11.0.21, and 11.1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cve.org/CVERecord?id=CVE-2025-35041 - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-
org/CVERecord?id=CVE-2025-35041 - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-265-01.json
CVE ID: CVE-2025-35042 State: PUBLISHED Published: 2025-09-22T15:57:03.528Z Last Updated: 2025-09-30T16:48:42.980Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Airship AI Products: Acropolis Problem Types: CWE-1392 Description: Airship AI Acropolis includes a default administrative account that uses the same credentials on every installation. Instances of Airship AI that do not change this account password are vulnerable to a remote attacker logging in and gaining the privileges of this account. Fixed in 10.2.35, 11.0.21, and 11.1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cve.org/CVERecord?id=CVE-2025-35042 - https:
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cve.org/CVERecord?id=CVE-2025-35042 - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-265-01.json
CVE ID: CVE-2025-35050 State: PUBLISHED Published: 2025-10-09T20:19:12.867Z Last Updated: 2025-10-10T19:38:21.311Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Newforma Products: Project Center Problem Types: CWE-502, CWE-306 Description: Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. The vulnerable endpoint is used by Newforma Project Center Server (NPCS), so a compromised NIX system can be used to attack an associated NPCS system. To mitigate this vulnerability, restrict network acces
mised NIX system can be used to attack an associated NPCS system. To mitigate this vulnerability, restrict network access to the '/remoteweb/remote.rem' endpoint, for example using the IIS URL Rewrite Module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://projectcenter.help.newforma.com/overviews/info_exchange_overview/ - https://learn.microsoft.com/en-us/iis/extensions/url-rewrite-module/using-the-url-rewrite-module - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json - https://www.cve.org/CVERecord?id=CVE-2025-35050
CVE ID: CVE-2025-35051 State: PUBLISHED Published: 2025-10-09T20:19:43.826Z Last Updated: 2025-10-10T19:37:30.156Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Newforma Products: Project Center Problem Types: CWE-502, CWE-306 Description: Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. According to the recommended architecture, the vulnerable NPCS endpoint is only accessible on an internal network. To mitigate this vulnerability, restrict network access to NPCS. Additio
oint is only accessible on an internal network. To mitigate this vulnerability, restrict network access to NPCS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://projectcenter.help.newforma.com/overviews/info_exchange_overview/ - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json - https://www.cve.org/CVERecord?id=CVE-2025-35051
CVE ID: CVE-2025-35052 State: PUBLISHED Published: 2025-10-09T20:20:00.632Z Last Updated: 2025-10-15T16:15:19.858Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Newforma Products: Project Center Problem Types: CWE-321 Description: Newforma Info Exchange (NIX) uses a hard-coded key to encrypt certain query parameters. Some encrypted parameter values can specify paths to download files, potentially bypassing authentication and authorization, for example, the 'qs' parameter used in '/DownloadWeb/download.aspx'. This key is shared across NIX installations. NIX 2023.3 and 2024.1 limit the use of hard-coded keys. Additional Analyst Notes: - CISA ADP Vulnrichment
installations. NIX 2023.3 and 2024.1 limit the use of hard-coded keys. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cve.org/CVERecord?id=CVE-2025-35052 - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json
CVE ID: CVE-2025-35053 State: PUBLISHED Published: 2025-10-09T20:20:18.008Z Last Updated: 2025-10-10T19:36:34.260Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L) Vendors: Newforma Products: Project Center Problem Types: CWE-22, CWE-73 Description: Newforma Info Exchange (NIX) accepts requests to '/UserWeb/Common/MarkupServices.ashx' specifying the 'DownloadExportedPDF' command that allow an authenticated user to read and delete arbitrary files with 'NT AUTHORITY\NetworkService' privileges. In Newforma before 2023.1, anonymous access is enabled by default (CVE-2025-35062), allowing an otherwise unauthenticated attacker to effectively authenticate as 'anonymous' and e
efault (CVE-2025-35062), allowing an otherwise unauthenticated attacker to effectively authenticate as 'anonymous' and exploit this file upload vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cve.org/CVERecord?id=CVE-2025-35062 - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json - https://www.cve.org/CVERecord?id=CVE-2025-35053
CVE ID: CVE-2025-35054 State: PUBLISHED Published: 2025-10-09T20:20:40.025Z Last Updated: 2025-10-10T19:35:47.871Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Newforma Products: Project Center Problem Types: CWE-922, CWE-522, CWE-257 Description: Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\<version>\Credentials'. The credentials are encrypted but the encryption key is stored in the same registry location. Authenticated users can access both the credentials and the encryption key. If these are Active Directory credentials, an attacker may be able to gain access to additional systems and res
ion key. If these are Active Directory credentials, an attacker may be able to gain access to additional systems and resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json - https://www.cve.org/CVERecord?id=CVE-2025-35054