CVEs (109)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Devolutions 1Devolutions Server Jun 17, 2026 Jul 7, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Incorrect permission management in Devolutions Server before 2022.2 allows a new user with a preexisting username to inherit the permissions of that previous user. |
HTML injection vulnerability in secure messages of Devolutions Server before 2022.2 allows attackers to alter the rendering of the page or redirect a user to another site. |
1Devolutions 1Devolutions Server Jun 17, 2026 Jul 12, 2021 N/A· v4 3.7 LOW· v3 4.3 MEDIUM· v2 Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack against the connections/partial endpoint (which accepts cleartext). |
1Devolutions 1Devolutions Server Jun 17, 2026 Apr 14, 2021 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 An SQL Injection issue in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows an administrative user to execute arbitrary SQL commands via a username in api/security/userinfo/delete. |
1Devolutions 1Devolutions Server Jun 17, 2026 Apr 14, 2021 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 An overly permissive CORS policy in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows a remote attacker to leak cross-origin data via a crafted HTML page. |
1Devolutions 1Devolutions Server Jun 17, 2026 Apr 1, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Devolutions Server before 2020.3. There is a cross-site scripting (XSS) vulnerability in entries of type Document. |
1Devolutions 1Devolutions Server Jun 17, 2026 Apr 1, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in Devolutions Server before 2020.3. There is an exposure of sensitive information in diagnostic files. |
1Devolutions 1Devolutions Server Jun 17, 2026 Apr 1, 2021 N/A· v4 8.1 HIGH· v3 4.9 MEDIUM· v2 An issue was discovered in Devolutions Server before 2020.3. There is Broken Authentication with Windows domain users. |
1Devolutions 1Devolutions Server Jun 17, 2026 Apr 1, 2021 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 An issue was discovered in Devolutions Server before 2020.3. There is broken access control on Password List entry elements. |