← Back

Devolutions

devolutions

181 CVEs • 11 products

Products (11)

Click to collapse
Toggle
Devolutions Server
devolutions_server
116 CVEs
Remote Desktop Manager
remote_desktop_manager
53 CVEs
Powershell Universal
powershell_universal
6 CVEs
Workspace
workspace
3 CVEs
Gfwx
gfwx
1 CVE
Password Hub
password_hub
1 CVE
Devolutions Gateway
devolutions_gateway
1 CVE
Remote Desktop Manager Powershell
remote_desktop_manager_powershell
1 CVE
Hub Reporting Service
hub_reporting_service
1 CVE
Unigetui
unigetui
1 CVE
Password Manager
password_manager
1 CVE

CVEs (181)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2022-3641
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Dec 12, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
Elevation of privilege in the Azure SQL Data Source in Devolutions Remote Desktop Manager 2022.3.13 to 2022.3.24 allows an authenticated user to spoof a privileged account.
CVE-2022-3781
1Devolutions
2Devolutions Server
Remote Desktop Manager
Jun 17, 2026
Nov 1, 2022
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Dashlane password and Keepass Server password in My Account Settings  are not encrypted in the database in Devolutions Remote Desktop Manager 2022.2.26 and prior versions and Devolutions Server 2022.3.1 and prior version...Show more
Dashlane password and Keepass Server password in My Account Settings  are not encrypted in the database in Devolutions Remote Desktop Manager 2022.2.26 and prior versions and Devolutions Server 2022.3.1 and prior versions which allows database users to read the data. This issue affects : Remote Desktop Manager 2022.2.26 and prior versions. Devolutions Server 2022.3.1 and prior versions. Show less
CVE-2022-3780
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Nov 1, 2022
N/A· v4
7.5 HIGH· v3
N/A· v2
Database connections on deleted users could stay active on MySQL data sources in Remote Desktop Manager 2022.3.7 and below which allow deleted users to access unauthorized data. This issue affects : Remote Desktop Man...Show more
Database connections on deleted users could stay active on MySQL data sources in Remote Desktop Manager 2022.3.7 and below which allow deleted users to access unauthorized data. This issue affects : Remote Desktop Manager 2022.3.7 and prior versions. Show less
CVE-2022-3182
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Sep 13, 2022
N/A· v4
7.0 HIGH· v3
N/A· v2
Improper Access Control vulnerability in the Duo SMS two-factor of Devolutions Remote Desktop Manager 2022.2.14 and earlier allows attackers to bypass the application lock. This issue affects: Devolutions Remote Desktop...Show more
Improper Access Control vulnerability in the Duo SMS two-factor of Devolutions Remote Desktop Manager 2022.2.14 and earlier allows attackers to bypass the application lock. This issue affects: Devolutions Remote Desktop Manager version 2022.2.14 and prior versions.Show less
CVE-2022-33996
1Devolutions
1Devolutions Server
Jun 17, 2026
Jul 7, 2022
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Incorrect permission management in Devolutions Server before 2022.2 allows a new user with a preexisting username to inherit the permissions of that previous user.
CVE-2022-2316
1Devolutions
1Devolutions Server
Jun 17, 2026
Jul 6, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
HTML injection vulnerability in secure messages of Devolutions Server before 2022.2 allows attackers to alter the rendering of the page or redirect a user to another site.
CVE-2022-2221
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Jun 27, 2022
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows authenticated users to access credentials of other users. This issue affects: Devolutions Remote Desk...Show more
Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows authenticated users to access credentials of other users. This issue affects: Devolutions Remote Desktop Manager versions prior to 2022.1.8.Show less
CVE-2022-33995
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Jun 21, 2022
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
A path traversal issue in entry attachments in Devolutions Remote Desktop Manager before 2022.2 allows attackers to create or overwrite files in an arbitrary location.
CVE-2022-1342
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Jun 15, 2022
N/A· v4
4.6 MEDIUM· v3
2.1 LOW· v2
A lack of password masking in Devolutions Remote Desktop Manager allows physically proximate attackers to observe sensitive data. A caching issue can cause sensitive fields to sometimes stay revealed when closing and reo...Show more
A lack of password masking in Devolutions Remote Desktop Manager allows physically proximate attackers to observe sensitive data. A caching issue can cause sensitive fields to sometimes stay revealed when closing and reopening a panel, which could lead to involuntarily disclosing sensitive information. This issue affects: Devolutions Remote Desktop Manager 2022.1.24 version and prior versions.Show less
CVE-2022-23849
1Devolutions
1Password Hub
Jun 17, 2026
Mar 3, 2022
N/A· v4
6.6 MEDIUM· v3
4.6 MEDIUM· v2
The biometric lock in Devolutions Password Hub for iOS before 2021.3.4 allows attackers to access the application because of authentication bypass. An attacker must rapidly make failed biometric authentication attempts.
CVE-2021-42098
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Oct 18, 2021
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
An incomplete permission check on entries in Devolutions Remote Desktop Manager before 2021.2.16 allows attackers to bypass permissions via batch custom PowerShell.
CVE-2021-36382
1Devolutions
1Devolutions Server
Jun 17, 2026
Jul 12, 2021
N/A· v4
3.7 LOW· v3
4.3 MEDIUM· v2
Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack against the connections/partial endpoint (which accepts cleartext).
CVE-2021-28157
1Devolutions
1Devolutions Server
Jun 17, 2026
Apr 14, 2021
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
An SQL Injection issue in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows an administrative user to execute arbitrary SQL commands via a username in api/security/userinfo/delete.
CVE-2021-28048
1Devolutions
1Devolutions Server
Jun 17, 2026
Apr 14, 2021
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
An overly permissive CORS policy in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2021-23925
1Devolutions
1Devolutions Server
Jun 17, 2026
Apr 1, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Devolutions Server before 2020.3. There is a cross-site scripting (XSS) vulnerability in entries of type Document.
CVE-2021-23924
1Devolutions
1Devolutions Server
Jun 17, 2026
Apr 1, 2021
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An issue was discovered in Devolutions Server before 2020.3. There is an exposure of sensitive information in diagnostic files.
CVE-2021-23923
1Devolutions
1Devolutions Server
Jun 17, 2026
Apr 1, 2021
N/A· v4
8.1 HIGH· v3
4.9 MEDIUM· v2
An issue was discovered in Devolutions Server before 2020.3. There is Broken Authentication with Windows domain users.
CVE-2021-23922
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Apr 1, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in Devolutions Remote Desktop Manager before 2020.2.12. There is a cross-site scripting (XSS) vulnerability in webviews.
CVE-2021-23921
1Devolutions
1Devolutions Server
Jun 17, 2026
Apr 1, 2021
N/A· v4
9.1 CRITICAL· v3
6.4 MEDIUM· v2
An issue was discovered in Devolutions Server before 2020.3. There is broken access control on Password List entry elements.
CVE-2021-28047
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Apr 1, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross-Site Scripting (XSS) in Administrative Reports in Devolutions Remote Desktop Manager before 2021.1 allows remote authenticated users to inject arbitrary web script or HTML via multiple input fields.