Vulnerabilidades de Devolutions
CVEs publicadas que afetam produtos de Devolutions: 81 registro(s), com severidade, exploração e correções.
Devolutions Server 61Powershell Universal 11Remote Desktop Manager 7Hub Reporting Service 1Unigetui 1Password Manager 1
CVE-2025-13757
Alta · 8.8
CWE-89 27/11/2025
SQL Injection em Devolutions Devolutions Server
SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.3.8.
CVE-2025-12808
Média · 6.5
CWE-284 06/11/2025
Improper Access Control em Devolutions Devolutions Server
Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custom values, resulting in password disclosure.
This issue affects the following versions :
* Devolutions Server 2025.3.2.0 through 2025.3.5.0
*
Devolutions Server 2025.2.15.0 and earlier
CVE-2025-12485
Alta · 8.8
CWE-269 06/11/2025
Improper Privilege Management em Devolutions Devolutions Server
Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie.This does not bypass the target account MFA verification step.
This issue affects the following versions :
* Devolutions Server 2025.3.2.0 through 2025.3.5.0
*
Devolutions Server 2025.2.15.0 and earlier
CVE-2025-11958
Média · 4.1
CWE-20 22/10/2025
Improper Input Validation em Devolutions Devolutions Server
An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a denial of service to the Security Dashboard via a crafted request.
CVE-2025-11957
Alta · 8.4
CWE-639 22/10/2025
Authorization Bypass Through User-Controlled Key (IDOR) em Devolutions Devolutions Server
Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or approve the temporary access requests of other users and gain unauthorized access to vaults and entries via crafted API requests.
CVE-2025-11619
Alta · 8.8
CWE-295 15/10/2025
Improper Certificate Validation em Devolutions Devolutions Server
Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic.