Devolutions: Security Vulnerabilities
Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on Windows allows an attacker with access to the user interface to obtain sensitive information via the error message dialog that displays the password in clear text.
CVSS Score
6.5
EPSS Score
0.001
Published
2023-04-02
Uncontrolled resource consumption in the logging feature in Devolutions Gateway 2023.1.1 and earlier allows an attacker to cause a denial of service by filling up the disk and render the system unusable.
CVSS Score
7.5
EPSS Score
0.002
Published
2023-04-02
Permission bypass when importing or synchronizing entries in User vault
in Devolutions Server 2022.3.13 and prior versions allows users with restricted rights to bypass entry permission via id collision.
CVSS Score
6.5
EPSS Score
0.0
Published
2023-04-02
Improper access control in the secure messages feature in Devolutions Server 2022.3.12 and below allows an authenticated attacker that possesses the message UUID to access the data it contains.
CVSS Score
6.5
EPSS Score
0.002
Published
2023-03-10
Improper removal of sensitive data in the entry edit feature of Hub Business submodule in Devolutions Remote Desktop Manager PowerShell Module 2022.3.1.5 and earlier allows an authenticated user to access sensitive data on entries that were edited using the affected submodule.
CVSS Score
6.5
EPSS Score
0.002
Published
2023-03-10
Improper access controls on some API endpoints in Devolutions Server 2022.3.12
and earlier could allow a standard privileged user to perform privileged
actions.
CVSS Score
8.8
EPSS Score
0.002
Published
2023-03-01
Improper access controls on entries in Devolutions Server
2022.3.12 and earlier could allow an authenticated user to access
sensitive data without proper authorization.
CVSS Score
6.5
EPSS Score
0.002
Published
2023-03-01
Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authenticated attacker to perform an SQL Injection, potentially resulting in unauthorized access to system resources.
CVSS Score
8.8
EPSS Score
0.003
Published
2023-03-01
Improper access control in Devolutions Server allows an authenticated user to access unauthorized sensitive data.
CVSS Score
6.5
EPSS Score
0.002
Published
2023-02-12
The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manager 2022.3.29 to 2022.3.30 allows a user to save sensitive data on disk.
CVSS Score
3.3
EPSS Score
0.001
Published
2023-01-26