Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
128 results · page 2 of 3
May 12, 2026Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notCVE-2026-5146 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records via missing session validation. This issue affects the following versions : * Devolutions Server 2026.1.6.0 through 2026.1.15.0 * Devolutions Server 2025.3.19.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secretCVE-2026-8407 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This issue affects the following versions : * Devolutions Server 2026.1.6.0 through 2026.1.11.0 * Devolutions Server 2025.3.16.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own confiCVE-2026-5175 · Other software · Devolutions · reported by security@devolutions.netMedium 5
Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own configured MFA factors and reduce account protection to password-only authentication via crafted HTTP requests. This issue affects Server: from 2026.1.6 through 2026.1.11.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request foCVE-2026-4989 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request forgery (SSRF), potentially leading to information disclosure, via a crafted API request. This issue affects Server: from 2026.1.1 through 2026.1.11, from 2025.3.1 through 2025.3.17.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys viaCVE-2026-4927 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys via an authenticated API request. This issue affects Server: from 2026.1.6 through 2026.1.11.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restrictions and remove theCVE-2026-4925 · Other software · Devolutions · reported by security@devolutions.netMedium 5
Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restrictions and remove their own multi-factor authentication (MFA) configuration via a crafted request. This issue affects Server: from 2026.1.6 through 2026.1.11.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credenCVE-2026-4924 · Other software · Devolutions · reported by security@devolutions.netHigh 8.2
Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multifactor authentication and gain unauthorized access to the victim account via reuse of a partially authenticated session token.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as otCVE-2026-4829 · Other software · Devolutions · reported by security@devolutions.netMedium 5.4
Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as other users, including administrators, via reuse of a session code from an external authentication flow.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass mCVE-2026-4828 · Other software · Devolutions · reported by security@devolutions.netHigh 8.2
Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multi-factor authentication via a crafted login request.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2026Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authenticated user to restoCVE-2026-3638 · Other software · Devolutions · reported by security@devolutions.netMedium 5.9
Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authenticated user to restore deleted users and roles via crafted API requests.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2026Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to aCVE-2026-3224 · Other software · Devolutions · reported by security@devolutions.netCritical 9.8
Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to authenticate as an arbitrary Entra ID user via a forged JSON Web Token (JWT).
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2026Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message viCVE-2026-3204 · Other software · Devolutions · reported by security@devolutions.netCritical 9.8
Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message via a specially crafted URL.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2026Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a CVE-2026-3130 · Other software · Devolutions · reported by security@devolutions.netCritical 9.8
Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is currently checked out by selecting it alongside at least one non-checked-out account and performing a bulk deletion.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the dCVE-2026-3221 · Other software · Devolutions · reported by security@devolutions.netMedium 4.9
Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the database to obtain sensitive user information via direct database access.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026A permission cache poisoning vulnerability in Devolutions Server allows authenticated users to bypass permissions to access entries.This issue affects DevolutioCVE-2026-1768 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
A permission cache poisoning vulnerability in Devolutions Server allows authenticated users to bypass permissions to access entries.This issue affects Devolutions Server: before 2025.3.15.
- Product
- Devolutions Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: froCVE-2026-1007 · Other software · Devolutions · reported by security@devolutions.netHigh 7.6
Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: from 2025.3.1 through 2025.3.12.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12CVE-2026-0610 · Other software · Devolutions · reported by security@devolutions.netCritical 9.8
SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Server: through 2025.3.8.CVE-2025-13683 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Server: through 2025.3.8.0; Remote Desktop Manager: through 2025.3.23.0.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2025Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: before 2025.2.21, befoCVE-2025-13765 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: before 2025.2.21, before 2025.3.9.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2025Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8.CVE-2025-13758 · Other software · Devolutions · reported by security@devolutions.netLow 3.5
Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2025SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.3.8.CVE-2025-13757 · Other software · Devolutions · reported by security@devolutions.netHigh 8.8
SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.3.8.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2025Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by CVE-2025-12485 · Other software · Devolutions · reported by security@devolutions.netHigh 8.8
Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie.This does not bypass the target account MFA verification step. This issue affects the following versions : * Devolutions Server 2025.3.2.0 through 2025.3.5.0 * Devolutions Server 2025.2.15.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2025An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a dCVE-2025-11958 · Other software · Devolutions · reported by security@devolutions.netMedium 5.1
An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a denial of service to the Security Dashboard via a crafted request.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2025Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or apprCVE-2025-11957 · Other software · Devolutions · reported by security@devolutions.netCritical 9
Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or approve the temporary access requests of other users and gain unauthorized access to vaults and entries via crafted API requests.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2025Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic.CVE-2025-11619 · Other software · Devolutions · reported by security@devolutions.netHigh 8.8
Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic.
- Product
- Devolutions Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025UI synchronization issue in the Just-in-Time (JIT) access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a remote authenticated CVE-2025-8353 · Other software · Devolutions · reported by security@devolutions.netMedium 5.9
UI synchronization issue in the Just-in-Time (JIT) access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a remote authenticated attacker to gain unauthorized access to deleted JIT Groups via stale UI state during standard checkout request processing.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out period due to a deadCVE-2025-8312 · Other software · Devolutions · reported by security@devolutions.netHigh 7.1
Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out period due to a deadlock occurring in the scheduling service.This issue affects the following version(s) : * Devolutions Server 2025.2.2.0 through 2025.2.5.0 * Devolutions Server 2025.1.12.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unauthorized entries via the secure message entrCVE-2025-6741 · Other software · Devolutions · reported by security@devolutions.netHigh 7.1
Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unauthorized entries via the secure message entry attachment feature This issue affects the following versions : * Devolutions Server 2025.2.2.0 through 2025.2.4.0 * Devolutions Server 2025.1.11.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcinCVE-2025-6523 · Other software · Devolutions · reported by security@devolutions.netCritical 9.5
Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcing the short emergency codes generated by the server within a feasible timeframe. This issue affects the following versions : * Devolutions Server 2025.2.2.0 through 2025.2.3.0 * Devolutions Server 2025.1.11.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to remove or change admiCVE-2025-5382 · Other software · Devolutions · reported by security@devolutions.netMedium 6.8
Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to remove or change administrators MFA.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025Improper access control in Tor network blocking feature in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the tor blocking feCVE-2025-3768 · Other software · Devolutions · reported by security@devolutions.netMedium 5
Improper access control in Tor network blocking feature in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the tor blocking feature when the Devolutions hosted endpoint is not reachable.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "Edit permission" permCVE-2025-0691 · Other software · Devolutions · reported by security@devolutions.netMedium 5
Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "Edit permission" permission by bypassing the client side validation.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and "CVE-2025-4433 · Other software · Devolutions · reported by security@devolutions.netHigh 8.7
Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and "User Group Management" permissions to perform privilege escalation by adding users to groups with administrative privileges.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy viCVE-2025-4316 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy via specific user interface actions. This issue affects Devolutions Server versions from 2025.1.3.0 through 2025.1.6.0, and all versions up to 2024.3.15.0.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a previously configured usCVE-2025-3517 · Other software · Devolutions · reported by security@devolutions.netMedium 6.3
Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a previously configured user configured in a PAM JIT account via failure to update the internal account’s SID when updating the username.
- Product
- Devolutions Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2025Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an authenticated user to bypass the browser eCVE-2025-2280 · Other software · Devolutions · reported by security@devolutions.netHigh 8.1
Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an authenticated user to bypass the browser extension restriction feature.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2025Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user toCVE-2025-2278 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user to access information about these requests via a known request ID.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2025Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH password CVE-2025-2277 · Other software · Devolutions · reported by security@devolutions.netHigh 7.5
Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH password due to missing password masking.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' permission.CVE-2025-2003 · Other software · Devolutions · reported by security@devolutions.netHigh 7.1
Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' permission.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after check-iCVE-2025-1231 · Other software · Devolutions · reported by security@devolutions.netMedium 5.4
Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after check-in due to crash in the password reset functionality.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticated user to view the password history of anCVE-2024-12196 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticated user to view the password history of an entry without the view password permission.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets.CVE-2024-12151 · Other software · Devolutions · reported by security@devolutions.netMedium 5
Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authenticated user to access some reporting enCVE-2024-12148 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authenticated user to access some reporting endpoints.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Improper access control in the Password History feature in Devolutions DVLS 2024.3.6 and earlier allows a malicious authenticated user to obtain sensitive data CVE-2024-10971 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Improper access control in the Password History feature in Devolutions DVLS 2024.3.6 and earlier allows a malicious authenticated user to obtain sensitive data via faulty permission.
- Product
- DVLS (Devolutions Server)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2024Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users with permissions to appCVE-2024-6512 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users with permissions to approve their own requests, bypassing intended security restrictions, via the PAM access request approval mechanism.
- Product
- Devolutions Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2024Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to another user without CVE-2024-4846 · Other software · Devolutions · reported by security@devolutions.netMedium 6.3
Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to another user without being asked for the 2FA via another browser tab.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
May 17, 2024Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.11.0 and earlier allows an authenticated user with access to the PAM JIT eleCVE-2024-5072 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.11.0 and earlier allows an authenticated user with access to the PAM JIT elevation feature to manipulate the LDAP filter query via a specially crafted request.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Apr 9, 2024Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and Devolutions Server 20CVE-2024-3545 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and Devolutions Server 2024.1.8 and earlier allows an attacker to access sensitive informations contained in the offline cache file by gaining access to a computer where the software is installed even though the offline mode is disabled.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Apr 9, 2024Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation featurCVE-2024-2918 · Other software · Devolutions · reported by security@devolutions.netLow 3.6
Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to forge the displayed group in the PAM JIT elevation checkout request via a specially crafted request.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Mar 26, 2024Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to the PAM to access unaCVE-2024-2921 · Other software · Devolutions · reported by security@devolutions.netCritical 9.8
Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to the PAM to access unauthorized PAM entries via a specific set of permissions.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.