← Back

Devolutions

devolutions

181 CVEs • 11 products

Products (11)

Click to collapse
Toggle
Devolutions Server
devolutions_server
116 CVEs
Remote Desktop Manager
remote_desktop_manager
53 CVEs
Powershell Universal
powershell_universal
6 CVEs
Workspace
workspace
3 CVEs
Gfwx
gfwx
1 CVE
Password Hub
password_hub
1 CVE
Devolutions Gateway
devolutions_gateway
1 CVE
Remote Desktop Manager Powershell
remote_desktop_manager_powershell
1 CVE
Hub Reporting Service
hub_reporting_service
1 CVE
Unigetui
unigetui
1 CVE
Password Manager
password_manager
1 CVE

CVEs (181)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2024-11621
1Devolutions
2Remote Desktop Manager
Remote Desktop Manager Powershell
Jun 17, 2026
Feb 10, 2025
N/A· v4
8.8 HIGH· v3
N/A· v2
Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modify encrypted communications via a man-in-the-middle attack. Versions affected ar...Show more
Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modify encrypted communications via a man-in-the-middle attack. Versions affected are : Remote Desktop Manager macOS 2024.3.9.0 and earlier Remote Desktop Manager Linux 2024.3.2.5 and earlier Remote Desktop Manager Android 2024.3.3.7 and earlier Remote Desktop Manager iOS 2024.3.3.0 and earlier Remote Desktop Manager Powershell 2024.3.6.0 and earlierShow less
CVE-2024-12196
1Devolutions
1Devolutions Server
Jun 17, 2026
Dec 4, 2024
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticated user to view the password history of an entry without the view password permission.
CVE-2024-12151
1Devolutions
1Devolutions Server
Jun 17, 2026
Dec 4, 2024
N/A· v4
5.0 MEDIUM· v3
N/A· v2
Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets.
CVE-2024-12149
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Dec 4, 2024
N/A· v4
8.1 HIGH· v3
N/A· v2
Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an authenticated user that request temporary permissions on an entry...Show more
Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an authenticated user that request temporary permissions on an entry to obtain more privileges than requested.Show less
CVE-2024-12148
1Devolutions
1Devolutions Server
Jun 17, 2026
Dec 4, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authenticated user to access some reporting endpoints.
CVE-2024-11672
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Nov 25, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an authenticated malicious user to bypass the "Add" permission via the import in vault...Show more
Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an authenticated malicious user to bypass the "Add" permission via the import in vault feature.Show less
CVE-2024-11671
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Nov 25, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Improper authentication in SQL data source MFA validation in Devolutions Remote Desktop Manager 2024.3.17 and earlier on Windows allows an authenticated user to bypass the MFA validation via data source switching.
CVE-2024-11670
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Nov 25, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows a malicious authenticated user to bypass the "View Password" permission via spe...Show more
Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows a malicious authenticated user to bypass the "View Password" permission via specific actions.Show less
CVE-2024-10971
1Devolutions
1Devolutions Server
Jun 17, 2026
Nov 12, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Improper access control in the Password History feature in Devolutions DVLS 2024.3.6 and earlier allows a malicious authenticated user to obtain sensitive data via faulty permission.
CVE-2024-7421
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Sep 25, 2024
N/A· v4
5.5 MEDIUM· v3
N/A· v2
An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to system logs to obtain session credentials via passwords included in command-line argu...Show more
An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to system logs to obtain session credentials via passwords included in command-line arguments when launching WinSCP sessionsShow less
CVE-2024-6512
1Devolutions
1Devolutions Server
Jun 17, 2026
Sep 25, 2024
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users with permissions to approve their own requests, bypassing intended security restric...Show more
Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users with permissions to approve their own requests, bypassing intended security restrictions, via the PAM access request approval mechanism.Show less
CVE-2024-6492
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Jul 16, 2024
N/A· v4
7.4 HIGH· v3
N/A· v2
Exposure of Sensitive Information in edge browser session proxy feature in Devolutions Remote Desktop Manager 2024.2.14.0 and earlier on Windows allows an attacker to intercept proxy credentials via a specially crafted w...Show more
Exposure of Sensitive Information in edge browser session proxy feature in Devolutions Remote Desktop Manager 2024.2.14.0 and earlier on Windows allows an attacker to intercept proxy credentials via a specially crafted website.Show less
CVE-2024-6354
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Jun 26, 2024
N/A· v4
7.2 HIGH· v3
N/A· v2
Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the execute permission via the use of the PAM dashboard.
CVE-2024-4846
1Devolutions
1Devolutions Server
Jun 17, 2026
Jun 25, 2024
N/A· v4
6.3 MEDIUM· v3
N/A· v2
Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to another user without being asked for the 2FA via another browser tab.
CVE-2024-6057
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Jun 17, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an access to an RDM instance to bypass the vault master password...Show more
Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an access to an RDM instance to bypass the vault master password via the offline mode feature.Show less
CVE-2024-6055
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Jun 17, 2024
N/A· v4
4.7 MEDIUM· v3
N/A· v2
Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an attacker that obtains the exported settings to recover powershell...Show more
Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an attacker that obtains the exported settings to recover powershell credentials configured on the data source via stealing the configuration file.Show less
CVE-2024-5072
1Devolutions
1Devolutions Server
Jun 17, 2026
May 17, 2024
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.11.0 and earlier allows an authenticated user with access to the PAM JIT elevation feature to manipulate the LDAP filter query via a spe...Show more
Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.11.0 and earlier allows an authenticated user with access to the PAM JIT elevation feature to manipulate the LDAP filter query via a specially crafted request.Show less
CVE-2024-3545
1Devolutions
2Devolutions Server
Remote Desktop Manager
Jun 17, 2026
Apr 9, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and Devolutions Server 2024.1.8 and earlier allows an attacker to access sensitive in...Show more
Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and Devolutions Server 2024.1.8 and earlier allows an attacker to access sensitive informations contained in the offline cache file by gaining access to a computer where the software is installed even though the offline mode is disabled. Show less
CVE-2024-2918
1Devolutions
1Devolutions Server
Jun 17, 2026
Apr 9, 2024
N/A· v4
3.6 LOW· v3
N/A· v2
Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to forge the displayed group in the PAM JIT elevation chec...Show more
Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to forge the displayed group in the PAM JIT elevation checkout request via a specially crafted request. Show less
CVE-2024-2921
1Devolutions
1Devolutions Server
Jun 17, 2026
Mar 26, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to the PAM to access unauthorized PAM entries via a specific set of permissions.