Devolutions vulnerabilities
199 CVEs and advisories name Devolutions as an affected vendor, newest first. Follow it as a feed.
- CVE-2023-1202Permission bypass when importing or synchronizing entries in User vault in Devolutions Remote Desktop Manager 2023.1.9 and prior versions
- CVE-2023-1580Uncontrolled resource consumption in the logging feature in Devolutions Gateway 2023.1.1 and earlier allows an attacker to cause a denial of
- CVE-2023-1574Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on Windo
- CVE-2023-1201Improper access control in the secure messages feature in Devolutions Server 2022.3.12 and below allows an authenticated attacker that posse
- CVE-2023-1203Improper removal of sensitive data in the entry edit feature of Hub Business submodule in Devolutions Remote Desktop Manager PowerShell Modu
- CVE-2023-0952Improper access controls on entries in Devolutions Server 2022.3.12 and earlier could allow an authenticated user to access sensitive data
- CVE-2023-0951Improper access controls on some API endpoints in Devolutions Server 2022.3.12 and earlier could allow a standard privileged user to perfor
- CVE-2023-0953Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authenticated attacker to
- CVE-2023-0661Improper access control in Devolutions Server allows an authenticated user to access unauthorized sensitive data.
- CVE-2023-0463The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manager 2022.3.29 to 2022
- CVE-2022-4287Authentication bypass in local application lock feature in Devolutions Remote Desktop Manager 2022.3.26 and earlier on Windows allows malic
- CVE-2022-3641Elevation of privilege in the Azure SQL Data Source in Devolutions Remote Desktop Manager 2022.3.13 to 2022.3.24 allows an authenticated use
- CVE-2022-3781Dashlane password and Keepass Server password in My Account Settings are not encrypted in the database in Devolutions Remote Desktop Manage
- CVE-2022-3780Database connections on deleted users could stay active on MySQL data sources in Remote Desktop Manager 2022.3.7 and below which allow delet
- CVE-2022-3182Improper Access Control vulnerability in the Duo SMS two-factor of Devolutions Remote Desktop Manager 2022.2.14 and earlier allows attackers
- CVE-2022-2316HTML injection vulnerability in secure messages of Devolutions Server before 2022.2 allows attackers to alter the rendering of the page or r
- CVE-2022-2221Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows authenticated users t
- CVE-2022-1342A lack of password masking in Devolutions Remote Desktop Manager allows physically proximate attackers to observe sensitive data.
- CVE-2021-42098An incomplete permission check on entries in Devolutions Remote Desktop Manager before 2021.2.16 allows attackers to bypass permissions via