← Back

Devolutions

devolutions

168 CVEs • 10 products

Products (10)

Click to collapse
Toggle
Devolutions Server
devolutions_server
109 CVEs
Remote Desktop Manager
remote_desktop_manager
53 CVEs
Workspace
workspace
3 CVEs
Gfwx
gfwx
1 CVE
Password Hub
password_hub
1 CVE
Devolutions Gateway
devolutions_gateway
1 CVE
Remote Desktop Manager Powershell
remote_desktop_manager_powershell
1 CVE
Hub Reporting Service
hub_reporting_service
1 CVE
Unigetui
unigetui
1 CVE
Powershell Universal
powershell_universal
1 CVE

CVEs (168)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2025-2278
1Devolutions
1Devolutions Server
Jun 17, 2026
Mar 13, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user to access information about these requests via a known request...Show more
Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user to access information about these requests via a known request ID.Show less
CVE-2025-2277
1Devolutions
1Devolutions Server
Jun 17, 2026
Mar 13, 2025
N/A· v4
7.5 HIGH· v3
N/A· v2
Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH password due to missing password masking.
CVE-2025-1636
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Mar 13, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows an authenticated user to inadvertently leak the My Per...Show more
Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows an authenticated user to inadvertently leak the My Personal Credentials in a shared vault via the clear history feature due to faulty business logic.Show less
CVE-2025-1635
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Mar 13, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows a user exporting a hub data source to include his authenticated session in...Show more
Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows a user exporting a hub data source to include his authenticated session in the export due to faulty business logic.Show less
CVE-2025-2003
1Devolutions
1Devolutions Server
Jun 17, 2026
Mar 5, 2025
N/A· v4
7.1 HIGH· v3
N/A· v2
Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' permission.
CVE-2025-1231
1Devolutions
1Devolutions Server
Jun 17, 2026
Feb 11, 2025
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after check-in due to crash in the password reset functionality.
CVE-2025-1193
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Feb 10, 2025
N/A· v4
8.1 HIGH· v3
N/A· v2
Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on 2024.3.19 and earlier on Windows allows an attacker to intercept and modify encrypted communications via a man-in-...Show more
Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on 2024.3.19 and earlier on Windows allows an attacker to intercept and modify encrypted communications via a man-in-the-middle attack by presenting a certificate for a different host.Show less
CVE-2024-11621
1Devolutions
2Remote Desktop Manager
Remote Desktop Manager Powershell
Jun 17, 2026
Feb 10, 2025
N/A· v4
8.8 HIGH· v3
N/A· v2
Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modify encrypted communications via a man-in-the-middle attack. Versions affected ar...Show more
Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modify encrypted communications via a man-in-the-middle attack. Versions affected are : Remote Desktop Manager macOS 2024.3.9.0 and earlier Remote Desktop Manager Linux 2024.3.2.5 and earlier Remote Desktop Manager Android 2024.3.3.7 and earlier Remote Desktop Manager iOS 2024.3.3.0 and earlier Remote Desktop Manager Powershell 2024.3.6.0 and earlierShow less
CVE-2024-12196
1Devolutions
1Devolutions Server
Jun 17, 2026
Dec 4, 2024
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticated user to view the password history of an entry without the view password permission.
CVE-2024-12151
1Devolutions
1Devolutions Server
Jun 17, 2026
Dec 4, 2024
N/A· v4
5.0 MEDIUM· v3
N/A· v2
Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets.
CVE-2024-12149
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Dec 4, 2024
N/A· v4
8.1 HIGH· v3
N/A· v2
Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an authenticated user that request temporary permissions on an entry...Show more
Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an authenticated user that request temporary permissions on an entry to obtain more privileges than requested.Show less
CVE-2024-12148
1Devolutions
1Devolutions Server
Jun 17, 2026
Dec 4, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authenticated user to access some reporting endpoints.
CVE-2024-11672
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Nov 25, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an authenticated malicious user to bypass the "Add" permission via the import in vault...Show more
Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an authenticated malicious user to bypass the "Add" permission via the import in vault feature.Show less
CVE-2024-11671
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Nov 25, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Improper authentication in SQL data source MFA validation in Devolutions Remote Desktop Manager 2024.3.17 and earlier on Windows allows an authenticated user to bypass the MFA validation via data source switching.
CVE-2024-11670
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Nov 25, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows a malicious authenticated user to bypass the "View Password" permission via spe...Show more
Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows a malicious authenticated user to bypass the "View Password" permission via specific actions.Show less
CVE-2024-10971
1Devolutions
1Devolutions Server
Jun 17, 2026
Nov 12, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Improper access control in the Password History feature in Devolutions DVLS 2024.3.6 and earlier allows a malicious authenticated user to obtain sensitive data via faulty permission.
CVE-2024-7421
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Sep 25, 2024
N/A· v4
5.5 MEDIUM· v3
N/A· v2
An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to system logs to obtain session credentials via passwords included in command-line argu...Show more
An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to system logs to obtain session credentials via passwords included in command-line arguments when launching WinSCP sessionsShow less
CVE-2024-6512
1Devolutions
1Devolutions Server
Jun 17, 2026
Sep 25, 2024
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users with permissions to approve their own requests, bypassing intended security restric...Show more
Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users with permissions to approve their own requests, bypassing intended security restrictions, via the PAM access request approval mechanism.Show less
CVE-2024-6492
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Jul 16, 2024
N/A· v4
7.4 HIGH· v3
N/A· v2
Exposure of Sensitive Information in edge browser session proxy feature in Devolutions Remote Desktop Manager 2024.2.14.0 and earlier on Windows allows an attacker to intercept proxy credentials via a specially crafted w...Show more
Exposure of Sensitive Information in edge browser session proxy feature in Devolutions Remote Desktop Manager 2024.2.14.0 and earlier on Windows allows an attacker to intercept proxy credentials via a specially crafted website.Show less
CVE-2024-6354
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Jun 26, 2024
N/A· v4
7.2 HIGH· v3
N/A· v2
Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the execute permission via the use of the PAM dashboard.