Netwrix: Security Vulnerabilities
Netwrix Directory Manager (formerly Imanami GroupID) through v.10.0.7784.0 has a hard-coded password.
CVSS Score
10.0
EPSS Score
0.001
Published
2025-05-29
Netwrix Directory Manager v.11.0.0.0 and before & after v.11.1.25134.03 contains a hardcoded password.
CVSS Score
5.3
EPSS Score
0.001
Published
2025-05-28
Netwrix Directory Manager (formerly Imanami GroupID) before and including v.11.0.0.0 and after v.11.1.25134.03 has Incorrect Permission Assignment for a Critical Resource.
CVSS Score
5.0
EPSS Score
0.0
Published
2025-05-28
Netwrix Directory Manager (formerly Imanami GroupID) v11.0.0.0 and before & after v.11.1.25134.03 inserts Sensitive Information into Sent Data.
CVSS Score
9.1
EPSS Score
0.001
Published
2025-05-28
Netwrix Directory Manager (formerly Imanami GroupID) v.11.0.0.0 and before, as well as after v.11.1.25134.03 lacks Authentication for a Critical Function.
CVSS Score
6.5
EPSS Score
0.001
Published
2025-05-28
Netwrix Password Secure 9.2.0.32454 allows OS command injection.
CVSS Score
9.8
EPSS Score
0.004
Published
2025-04-03
Netwrix Password Secure through 9.2 allows command injection.
CVSS Score
9.8
EPSS Score
0.004
Published
2025-04-03
Netwrix Usercube before 6.0.215, in certain misconfigured on-premises installations, allows authentication bypass on deployment endpoints, leading to privilege escalation. This only occurs if the configuration omits the required restSettings.AuthorizedClientId and restSettings.AuthorizedSecret fields (for the POST /api/Deployment/ExportConfiguration and POST /api/Deployment endpoints).
CVSS Score
9.8
EPSS Score
0.0
Published
2023-11-28
CVE-2022-31199
Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. The remote code execution vulnerabilities exist within the underlying protocol used by the component, and potentially allow an unauthenticated remote attacker to execute arbitrary code as the NT AUTHORITY\SYSTEM user on affected systems, including on systems Netwrix Auditor monitors.
Known exploited
CVSS Score
9.8
EPSS Score
0.042
Published
2022-11-08
Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the Domain Administrator (that is configured within the product in its installation state) by generating a single Kerberos Pre-Authentication Failed (ID 4771) event on a Domain Controller.
CVSS Score
7.5
EPSS Score
0.063
Published
2020-10-20
Page 1