Ironmansoftware Powershell_universal
8 CVEs affecting Ironmansoftware Powershell_universal. Latest disclosed: 2026-06-12. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-49213 | High | 8.8 | 2023-11-23 | The API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary commands via crafted HTTP requests if a param… |
CVE-2022-45183 | High | 8.8 | 2022-11-14 | Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with a valid app token to retrieve other app… |
CVE-2026-4064 | High | 8.3 | 2026-03-17 | Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to by… |
CVE-2022-45184 | High | 7.2 | 2022-11-14 | The Web Server in Ironman Software PowerShell Universal v3.x and v2.x allows for directory traversal outside of the configuration directory, which allows a rem… |
CVE-2026-3277 | Medium | 6.5 | 2026-02-27 | The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the .universal/a… |
CVE-2026-0618 | Medium | 6.1 | 2026-01-07 | Cross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell Universal: before 4.5.6, before 5.6.13. |
CVE-2026-3563 | Medium | 5.5 | 2026-03-17 | Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to crea… |
CVE-2026-8694 | Medium | 5.3 | 2026-06-12 | Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification… |