CVE-2024-1900

The Devolutions Server (version 2023.3.14.0 and earlier) contains a vulnerability due to improper session management within the identity provider authentication flow. This flaw allows an authenticated user, who logged in via an identity provider like Okta or Microsoft O365 , to remain authenticat...

CVE-2024-1900

Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365. The use...

CVE-2024-1901

Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with specific PAM permissions to make PAM credentials unavailable...

CVE-2024-1901

A Denial of Service (DoS) vulnerability exists in Devolutions Server version 2023.3.14.0 (and prior versions) during the PAM password rotation process. This flaw occurs during the check-in process , where an authenticated user possessing specific PAM permissions can cause PAM credentials to becom...

CVE-2024-1901

Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with specific PAM permissions to make PAM credentials unavailable...

Devolutions Server Security Vulnerability

Devolutions Server is an application from Devolutions Canada. It provides a full-featured shared account and password management solution. A security vulnerability exists in Devolutions Server version 2023.3.14.0 and prior versions, which stems from improper privilege management in the Just-in-ti...

Devolutions Server Security Vulnerability

Devolutions Server is an application from Devolutions Canada. It provides a full-featured shared account and password management solution. A security vulnerability exists in Devolutions Server version 2023.3.14.0 and prior versions, which stems from incorrect access control in the notification...

Devolutions Server Security Vulnerability

Devolutions Server is an application from Devolutions Canada. provides a full-featured shared account and password management solution. A security vulnerability exists in Devolutions Server version 2023.3.14.0 and prior versions, which stems from incorrect session management in the identity...

Devolutions Server Security Vulnerability

Devolutions Server is an application from Devolutions Canada. It provides a full-featured shared account and password management solution. A security vulnerability exists in Devolutions Server version 2023.3.14.0 and prior versions, which originates from PAM password rotation during the sign-in...

PT-2024-18405

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2023.3.14.0 and earlier Description The issue is related to improper access control in the notification feature, allowing a low-privileged user to change notification settings configured by an administrator...

PT-2024-18407

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2023.3.14.0 and earlier Description The issue is related to improper session management in the identity provider authentication flow. This allows an authenticated user, via an identity provider such as Okta or...

PT-2024-18408

Name of the Vulnerable Software and Affected Versions Devolutions Server version 2023.3.14.0 Description The issue allows an authenticated user with specific PAM permissions to make PAM credentials unavailable during the check-in process in PAM password rotation, resulting in a denial of service...

PT-2024-18286

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2023.3.14.0 and earlier Description The issue is related to improper privilege management in the Just-in-time JIT elevation module. This allows a user to continue using elevated privileges even after they have...

CVE-2024-1764: Improper Privilege Management

Improper privilege management in Just-in-time JIT elevation module in Devolutions Server 2023.3.14.0 and earlier allows a user to continue using the elevated privilege even after the expiration under specific circumstances...

CVE-2024-1898: Improper Access Control

Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privileged user to change notifications settings configured by an administrator...

CVE-2024-1900: Insufficient Session Expiration

Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365. The use...

CVE-2024-1901: Undefined Security Weakness

Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with specific PAM permissions to make PAM credentials unavailable...

CVE-2023-6588

Offline mode is always enabled, even if permission disallows it, in Devolutions Server data source in Devolutions Workspace 2023.3.2.0 and earlier. This allows an attacker with access to the Workspace application to access credentials when offline...

CVE-2023-6588

Offline mode is always enabled, even if permission disallows it, in Devolutions Server data source in Devolutions Workspace 2023.3.2.0 and earlier. This allows an attacker with access to the Workspace application to access credentials when offline...

CVE-2023-6588

Offline mode is always enabled, even if permission disallows it, in Devolutions Server data source in Devolutions Workspace 2023.3.2.0 and earlier. This allows an attacker with access to the Workspace application to access credentials when offline...