Devolutions
Page 2 of 2 — Devolutions CVEs from a corpus of 151, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1231 | Medium | 5.4 | 2025-02-11 | Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after check-… |
CVE-2025-1193 | High | 8.1 | 2025-02-10 | Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on 2024.3.19 and earlier on Windows allows an attacker t… |
CVE-2024-11621 | High | 8.8 | 2025-02-10 | Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modify encrypted communi… |
CVE-2024-12196 | Medium | 6.5 | 2024-12-04 | Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticated user to view the password history of a… |
CVE-2024-12151 | Medium | 5.0 | 2024-12-04 | Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets. |
CVE-2024-12149 | High | 8.1 | 2024-12-04 | Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an authe… |
CVE-2024-12148 | Medium | 4.3 | 2024-12-04 | Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authenticated user to access some reporting e… |
CVE-2024-11862 | | 2024-11-27 | Non constant time cryptographic operation in Devolutions.XTS.NET 2024.11.19 and earlier allows an attacker to render half of the encryption key obsolete via a… | |
CVE-2024-11672 | Medium | 4.3 | 2024-11-25 | Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an authenticated maliciou… |
CVE-2024-11671 | Medium | 5.4 | 2024-11-25 | Improper authentication in SQL data source MFA validation in Devolutions Remote Desktop Manager 2024.3.17 and earlier on Windows allows an authenticated user t… |
CVE-2024-11670 | Medium | 5.4 | 2024-11-25 | Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows a malicious authen… |
CVE-2024-10971 | Medium | 4.3 | 2024-11-12 | Improper access control in the Password History feature in Devolutions DVLS 2024.3.6 and earlier allows a malicious authenticated user to obtain sensitive data… |
CVE-2024-7421 | Medium | 5.5 | 2024-09-25 | An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to system logs to obtain se… |
CVE-2024-6512 | Medium | 6.5 | 2024-09-25 | Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users with permissions to ap… |
CVE-2024-6492 | High | 7.4 | 2024-07-16 | Exposure of Sensitive Information in edge browser session proxy feature in Devolutions Remote Desktop Manager 2024.2.14.0 and earlier on Windows allows an atta… |
CVE-2024-6354 | High | 7.2 | 2024-06-26 | Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the exec… |
CVE-2024-4846 | Medium | 6.3 | 2024-06-25 | Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to another user without… |
CVE-2024-6057 | Critical | 9.8 | 2024-06-17 | Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an… |
CVE-2024-6055 | Medium | 4.7 | 2024-06-17 | Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an atta… |
CVE-2024-5072 | Medium | 6.5 | 2024-05-17 | Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.11.0 and earlier allows an authenticated user with access to the PAM JIT el… |
CVE-2024-3545 | Medium | 4.3 | 2024-04-09 | Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and Devolutions Server 2… |
CVE-2024-2918 | Low | 3.6 | 2024-04-09 | Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation featu… |
CVE-2024-2921 | Critical | 9.8 | 2024-03-26 | Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to the PAM to access un… |
CVE-2024-2915 | High | 8.8 | 2024-03-26 | Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to elev… |
CVE-2024-2403 | Medium | 5.9 | 2024-03-13 | Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and earlier on Windows allows an attacker that compromis… |
CVE-2024-2241 | Medium | 6.3 | 2024-03-07 | Improper access control in the user interface in Devolutions Workspace 2024.1.0 and earlier allows an authenticated user to perform unintended actions via spec… |
CVE-2024-1901 | Medium | 4.3 | 2024-03-05 | Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with specific PAM permiss… |
CVE-2024-1900 | Medium | 5.5 | 2024-03-05 | Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an iden… |
CVE-2024-1898 | Medium | 4.3 | 2024-03-05 | Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privileged user to change notifications settings… |
CVE-2024-1764 | High | 7.6 | 2024-03-05 | Improper privilege management in Just-in-time (JIT) elevation module in Devolutions Server 2023.3.14.0 and earlier allows a user to continue using the elevated… |
CVE-2024-0589 | Medium | 5.4 | 2024-01-31 | Cross-site scripting (XSS) vulnerability in the entry overview tab in Devolutions Remote Desktop Manager 2023.3.36 and earlier on Windows allows an attacker wi… |
CVE-2023-7047 | Medium | 4.4 | 2023-12-21 | Inadequate validation of permissions when employing remote tools and macros via the context menu within Devolutions Remote Desktop Manager versions 2023.3.31… |
CVE-2023-6593 | Critical | 9.8 | 2023-12-12 | Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the application to ex… |
CVE-2023-6588 | Medium | 6.5 | 2023-12-07 | Offline mode is always enabled, even if permission disallows it, in Devolutions Server data source in Devolutions Workspace 2023.3.2.0 and earlier. This a… |
CVE-2023-6288 | High | 7.8 | 2023-12-06 | Code injection in Remote Desktop Manager 2023.3.9.3 and earlier on macOS allows an attacker to execute code via the DYLIB_INSERT_LIBRARIES environment variable… |
CVE-2023-6264 | Medium | 5.3 | 2023-11-22 | Information leak in Content-Security-Policy header in Devolutions Server 2023.3.7.0 allows an unauthenticated attacker to list the configured Devolutions Gatew… |
CVE-2023-5766 | Critical | 9.8 | 2023-11-01 | A remote code execution vulnerability in Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to remotely execute code from another win… |
CVE-2023-5765 | Critical | 9.8 | 2023-11-01 | Improper access control in the password analyzer feature in Devolutions Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to bypass pe… |
CVE-2023-5358 | Medium | 5.3 | 2023-11-01 | Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0 and earlier allows attackers to retrieve logs from vaults or entries th… |
CVE-2023-5575 | Medium | 6.5 | 2023-10-16 | Improper access control in the permission inheritance in Devolutions Server 2022.3.13.0 and earlier allows an attacker that compromised a low privileged user… |
CVE-2023-5240 | High | 7.5 | 2023-10-13 | Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with permission to manage PAM propagation scrip… |
CVE-2023-4417 | Medium | 6.5 | 2023-08-21 | Improper access controls in the entry duplication component in Devolutions Remote Desktop Manager 2023.2.19 and earlier versions on Windows allows an authentic… |
CVE-2023-4373 | Critical | 9.8 | 2023-08-21 | Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 and earlier permits a… |
CVE-2023-2400 | Low | 2.7 | 2023-06-20 | Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view users vaults of delete… |
CVE-2023-2445 | Medium | 4.9 | 2023-05-02 | Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers with administrator privileges to retrie… |
CVE-2023-2282 | Medium | 6.5 | 2023-04-25 | Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows allows an authenticated user to bypass… |
CVE-2023-2257 | High | 7.8 | 2023-04-24 | Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access t… |
CVE-2023-2118 | Medium | 5.4 | 2023-04-21 | Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send support tickets and d… |
CVE-2023-1980 | Medium | 6.5 | 2023-04-11 | Two factor authentication bypass on login in Devolutions Remote Desktop Manager 2022.3.35 and earlier allow user to cancel the two factor authentication via… |
CVE-2023-1939 | Medium | 4.3 | 2023-04-11 | No access control for the OTP key on OTP entries in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager L… |
CVE-2023-1603 | Medium | 6.5 | 2023-04-02 | Permission bypass when importing or synchronizing entries in User vault in Devolutions Server 2022.3.13 and prior versions allows users with restricted righ… |
CVE-2023-1580 | High | 7.5 | 2023-04-02 | Uncontrolled resource consumption in the logging feature in Devolutions Gateway 2023.1.1 and earlier allows an attacker to cause a denial of service by filling… |
CVE-2023-1574 | Medium | 6.5 | 2023-04-02 | Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on Windows allows an attack… |
CVE-2023-1202 | Medium | 6.5 | 2023-04-02 | Permission bypass when importing or synchronizing entries in User vault in Devolutions Remote Desktop Manager 2023.1.9 and prior versions allows users with r… |
CVE-2023-1203 | Medium | 6.5 | 2023-03-10 | Improper removal of sensitive data in the entry edit feature of Hub Business submodule in Devolutions Remote Desktop Manager PowerShell Module 2022.3.1.5 and e… |
CVE-2023-1201 | Medium | 6.5 | 2023-03-10 | Improper access control in the secure messages feature in Devolutions Server 2022.3.12 and below allows an authenticated attacker that possesses the message UU… |
CVE-2023-0953 | High | 8.8 | 2023-03-01 | Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authenticated attacker to perform an SQL Inj… |
CVE-2023-0952 | Medium | 6.5 | 2023-03-01 | Improper access controls on entries in Devolutions Server 2022.3.12 and earlier could allow an authenticated user to access sensitive data without proper aut… |
CVE-2023-0951 | High | 8.8 | 2023-03-01 | Improper access controls on some API endpoints in Devolutions Server 2022.3.12 and earlier could allow a standard privileged user to perform privileged actio… |
CVE-2023-0661 | Medium | 6.5 | 2023-02-12 | Improper access control in Devolutions Server allows an authenticated user to access unauthorized sensitive data. |
CVE-2023-0463 | Low | 3.3 | 2023-01-26 | The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manager 2022.3.29 to 2022.3.30 allows a user… |
CVE-2022-26964 | High | 7.4 | 2022-12-26 | Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure via a password brute-force attack. An err… |
CVE-2022-4287 | High | 8.8 | 2022-12-21 | Authentication bypass in local application lock feature in Devolutions Remote Desktop Manager 2022.3.26 and earlier on Windows allows malicious user to access… |
CVE-2022-3641 | High | 8.8 | 2022-12-12 | Elevation of privilege in the Azure SQL Data Source in Devolutions Remote Desktop Manager 2022.3.13 to 2022.3.24 allows an authenticated user to spoof a privil… |
CVE-2022-3781 | Medium | 6.5 | 2022-11-01 | Dashlane password and Keepass Server password in My Account Settings are not encrypted in the database in Devolutions Remote Desktop Manager 2022.2.26 and pri… |
CVE-2022-3780 | High | 7.5 | 2022-11-01 | Database connections on deleted users could stay active on MySQL data sources in Remote Desktop Manager 2022.3.7 and below which allow deleted users to access… |
CVE-2022-3182 | High | 7.0 | 2022-09-13 | Improper Access Control vulnerability in the Duo SMS two-factor of Devolutions Remote Desktop Manager 2022.2.14 and earlier allows attackers to bypass the appl… |
CVE-2022-33996 | High | 8.8 | 2022-07-07 | Incorrect permission management in Devolutions Server before 2022.2 allows a new user with a preexisting username to inherit the permissions of that previous u… |
CVE-2022-2316 | Medium | 5.4 | 2022-07-06 | HTML injection vulnerability in secure messages of Devolutions Server before 2022.2 allows attackers to alter the rendering of the page or redirect a user to a… |
CVE-2022-2221 | Medium | 6.5 | 2022-06-27 | Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows authenticated users to access credential… |
CVE-2022-33995 | High | 7.5 | 2022-06-21 | A path traversal issue in entry attachments in Devolutions Remote Desktop Manager before 2022.2 allows attackers to create or overwrite files in an arbitrary l… |
CVE-2022-1342 | Medium | 4.6 | 2022-06-15 | A lack of password masking in Devolutions Remote Desktop Manager allows physically proximate attackers to observe sensitive data. A caching issue can cause sen… |
CVE-2022-23849 | Medium | 6.6 | 2022-03-03 | The biometric lock in Devolutions Password Hub for iOS before 2021.3.4 allows attackers to access the application because of authentication bypass. An attacker… |
CVE-2021-42098 | High | 8.8 | 2021-10-18 | An incomplete permission check on entries in Devolutions Remote Desktop Manager before 2021.2.16 allows attackers to bypass permissions via batch custom PowerS… |
CVE-2021-36382 | Low | 2.6 | 2021-07-12 | Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack against the connection… |
CVE-2021-28157 | High | 7.2 | 2021-04-14 | An SQL Injection issue in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows an administrative user to execute arbitrary SQL c… |
CVE-2021-28048 | Medium | 6.5 | 2021-04-14 | An overly permissive CORS policy in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows a remote attacker to leak cross-origin… |
CVE-2021-23925 | Medium | 6.1 | 2021-04-01 | An issue was discovered in Devolutions Server before 2020.3. There is a cross-site scripting (XSS) vulnerability in entries of type Document. |
CVE-2021-23924 | High | 7.5 | 2021-04-01 | An issue was discovered in Devolutions Server before 2020.3. There is an exposure of sensitive information in diagnostic files. |
CVE-2021-23923 | High | 8.1 | 2021-04-01 | An issue was discovered in Devolutions Server before 2020.3. There is Broken Authentication with Windows domain users. |
CVE-2021-23922 | Medium | 5.4 | 2021-04-01 | An issue was discovered in Devolutions Remote Desktop Manager before 2020.2.12. There is a cross-site scripting (XSS) vulnerability in webviews. |
CVE-2021-23921 | Critical | 9.1 | 2021-04-01 | An issue was discovered in Devolutions Server before 2020.3. There is broken access control on Password List entry elements. |
CVE-2021-28047 | Medium | 5.4 | 2021-04-01 | Cross-Site Scripting (XSS) in Administrative Reports in Devolutions Remote Desktop Manager before 2021.1 allows remote authenticated users to inject arbitrary… |
CVE-2020-36211 | High | 7.0 | 2021-01-26 | An issue was discovered in the gfwx crate before 0.3.0 for Rust. Because ImageChunkMut does not have bounds on its Send trait or Sync trait, a data race and me… |