Filtered by vendor Devolutions
Subscribe
Total
181 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-13372 | 1 Devolutions | 1 Remote Desktop Manager | 2026-10-25 | N/A | 7.2 HIGH |
| Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 allows an authenticated attacker with write access to a shared workspace to execute a PowerShell script in another user's context via a display name collision with an existing VPN script link. | |||||
| CVE-2026-15641 | 1 Devolutions | 1 Devolutions Server | 2026-10-24 | N/A | 7.1 HIGH |
| Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request via a direct call to the request status endpoint, bypassing the required approver review. | |||||
| CVE-2026-15637 | 1 Devolutions | 1 Devolutions Server | 2026-10-24 | N/A | 7.5 HIGH |
| Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier. | |||||
| CVE-2026-15058 | 1 Devolutions | 1 Devolutions Server | 2026-10-24 | N/A | 3.1 LOW |
| Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier. | |||||
| CVE-2026-15642 | 1 Devolutions | 1 Devolutions Server | 2026-10-24 | N/A | 3.3 LOW |
| Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclude sensitive data is selected. | |||||
| CVE-2026-8497 | 3 Apple, Devolutions, Google | 4 Iphone Os, Macos, Password Manager and 1 more | 2026-10-24 | N/A | 7.4 HIGH |
| Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacent-network attacker to intercept and modify sensitive information via a forged TLS certificate. | |||||
| CVE-2026-17569 | 1 Devolutions | 1 Devolutions Server | 2026-10-24 | N/A | 4.3 MEDIUM |
| Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier | |||||
| CVE-2026-17570 | 1 Devolutions | 1 Devolutions Server | 2026-10-24 | N/A | 4.3 MEDIUM |
| Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier | |||||
| CVE-2026-16799 | 1 Devolutions | 1 Powershell Universal | 2026-10-24 | N/A | 5.0 MEDIUM |
| Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks. | |||||
| CVE-2026-16798 | 1 Devolutions | 1 Powershell Universal | 2026-10-24 | N/A | 6.5 MEDIUM |
| Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to strip the refresh token. | |||||
| CVE-2026-16801 | 1 Devolutions | 1 Powershell Universal | 2026-10-24 | N/A | 8.8 HIGH |
| Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when written to the variables configuration file. | |||||
| CVE-2026-16800 | 1 Devolutions | 1 Powershell Universal | 2026-10-24 | N/A | 8.8 HIGH |
| Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a script invocation. | |||||
| CVE-2026-17568 | 1 Devolutions | 1 Devolutions Server | 2026-10-24 | N/A | 8.8 HIGH |
| Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier | |||||
| CVE-2026-16802 | 1 Devolutions | 1 Powershell Universal | 2026-10-24 | N/A | 6.5 MEDIUM |
| Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected. | |||||
| CVE-2026-110804 | 1 Devolutions | 1 Devolutions Server | 2026-10-23 | N/A | 4.3 MEDIUM |
| Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request. | |||||
| CVE-2026-110805 | 1 Devolutions | 1 Devolutions Server | 2026-10-23 | N/A | 2.6 LOW |
| Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter. | |||||
| CVE-2026-110806 | 1 Devolutions | 1 Devolutions Server | 2026-10-23 | N/A | 6.5 MEDIUM |
| Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data. | |||||
| CVE-2026-110287 | 1 Devolutions | 1 Devolutions Server | 2026-10-23 | N/A | 4.3 MEDIUM |
| Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint. | |||||
| CVE-2025-13757 | 1 Devolutions | 1 Devolutions Server | 2026-10-18 | N/A | 8.8 HIGH |
| SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.3.8. | |||||
| CVE-2025-13765 | 1 Devolutions | 1 Devolutions Server | 2026-10-18 | N/A | 4.3 MEDIUM |
| Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: before 2025.2.21, before 2025.3.9. | |||||