943 matches found
CVE-2026-13327
Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate...
CVE-2026-90969
Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters...
CVE-2026-90971
Server-Side Request Forgery SSRF in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for...
CVE-2026-84850
Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept and tamper with outbound TLS connections via a spoofed or self-signed certificate...
CVE-2026-13327
Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate...
CVE-2026-13327
Devolutions Server versions 2026.2.16 and earlier are affected by an improper certificate validation flaw in its LDAPS connections to Active Directory. A network-positioned attacker can present a spoofed domain controller certificate to intercept privileged directory service credentials . CISA SS...
EUVD-2026-79189
Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate...
CVE-2026-84850
CVE-2026-84850 affects the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier . The root cause is improper certificate validation , which allows a network-positioned attacker to perform a man-in-the-middle attack, intercepting and tampe...
CVE-2026-84850
Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept and tamper with outbound TLS connections via a spoofed or self-signed certificate...
EUVD-2026-79188
Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept and tamper with outbound TLS connections via a spoofed or self-signed certificate...
CVE-2026-84850
Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept and tamper with outbound TLS connections via a spoofed or self-signed certificate...
CVE-2026-90969
Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters...
CVE-2026-90969
Devolutions Server versions 2026.2.16 and earlier are affected by an improper access control vulnerability in the vault entry listing feature . An authenticated user who lacks the view-password permission can obtain cleartext passwords by sending a request to the entry listing endpoint with passw...
CVE-2026-90969
Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters...
EUVD-2026-79185
Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters...
CVE-2026-90971
Server-Side Request Forgery SSRF in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for...
CVE-2026-90971
Devolutions Server 2026.2.16 and earlier is affected by a Server-Side Request Forgery (SSRF) in its VMware synchronization feature. A low-privileged authenticated user can submit a crafted connection definition during datacenter discovery, enabling them to obtain other users' credentials and reac...
EUVD-2026-79181
Server-Side Request Forgery SSRF in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for...
PT-2026-92410
Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters...
PT-2026-92412
Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate...