Devolutions Server security vulnerabilities

Devolutions Server is an application system developed by the Canadian company Devolutions. It provides a fully functional solution for shared accounts and password management. Versions of Devolutions Server prior to 2025.3.12 contained a security vulnerability due to SQL injection vulnerabilities...

CVE-2024-2915

Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to elevate themselves to unauthorized groups via a specially crafted request...

CVE-2024-2921

Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to the PAM to access unauthorized PAM entries via a specific set of permissions...

CVE-2024-2918

Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to forge the displayed group in the PAM JIT elevation checkout request via a specially crafted request...

CVE-2025-13683

Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Server: through 2025.3.8.0; Remote Desktop Manager: through 2025.3.23.0...

The email service of the Devolutions Server platform is vulnerable to attacks, allowing attackers to gain unauthorized access to protected information. This vulnerability enables attackers to manage passwords, user accounts, and confidential data in a centralized and secure manner.

The vulnerability of the email service of the Devolutions Server platform for centralized and secure management of passwords, account information, and confidential data is related to insufficient protection of sensitive data. Exploiting this vulnerability may allow an attacker operating remotely ...

The vulnerability of Devolutions Server’s platform for centralized and secure management of passwords, account information, and confidential data arises from the lack of protective measures for SQL query structures. This allows attackers to gain read-only access to data, modify it, and execute arbitrary code.

The vulnerability of the Devolutions Server platform for centralized and secure management of passwords, user accounts, and confidential information is related to the lack of measures taken to protect the SQL query structure when processing the DateSortField parameter. Exploiting this vulnerabili...

The vulnerability of the PAM module of the Devolutions Server platform, which enables centralized and secure management of passwords, user accounts, and confidential information. This vulnerability allows attackers to enhance their privileges.

The vulnerability of the PAM module of the Devolutions Server platform, which is used for centralized and secure management of passwords, user accounts, and confidential information, is related to access control errors. Exploiting this vulnerability can allow a malicious actor to enhance their...

The vulnerability of the Devolutions Server platform for centralized and secure management of passwords, account information, and confidential data arises from insufficient protection of account information, allowing unauthorized access to protected data.

The vulnerability of the Devolutions Server platform for centralized and secure management of passwords, account information, and confidential data is related to insufficient protection of account information. Exploiting this vulnerability can allow an unauthorized attacker to gain unauthorized...

Devolutions Server < 2025.3.10.0 AI Integration API Key Exposure (DEVO-2025-0017)

The version of Devolutions Server installed on the remote host is prior to 2025.3.10.0, and is, therefore, affected by an AI integration API key exposure vulnerability: - Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows. This issue affects...

Unspecified Vulnerability in Devolutions Server

Devolutions Server is a security solution for managing privileged accounts and sessions, designed to help organizations centrally store and manage sensitive information such as passwords and credentials. Devolutions Server has an unspecified vulnerability that originates from exposing credentials...

Unspecified Vulnerability in Devolutions Server (CNVD-2025-30126)

Devolutions Server is a security solution for managing privileged accounts and sessions, designed to help organizations centrally store and manage sensitive information such as passwords and credentials. An unspecified vulnerability exists in Devolutions Server that stems from a non-administrativ...

Devolutions Server SQL Injection Vulnerability

Devolutions Server is a security solution for managing privileged accounts and sessions, designed to help organizations centrally store and manage sensitive information such as passwords and credentials. Devolutions Server suffers from an SQL injection vulnerability that stems from the...

Devolutions Server < 2025.2.21 / 2025.3.x < 2025.3.9 Multiple Vulnerabilities (DEVO-2025-0018)

The version of Devolutions Server installed on the remote host is prior to 2025.2.21, or 2025.3.x prior to 2025.3.8, and is, therefore, affected by multiple vulnerabilities: - SQL Injection vulnerability in last usage logs in Devolutions Server. This issue affects Devolutions Server: through...

EUVD-2025-199879

Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Server: through 2025.3.8.0; Remote Desktop Manager: through 2025.3.23.0...

CVE-2025-13683

Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Server: through 2025.3.8.0; Remote Desktop Manager: through 2025.3.23.0...

CVE-2025-13683

Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Server: through 2025.3.8.0; Remote Desktop Manager: through 2025.3.23.0...

CVE-2025-13683

Devolutions Server and Remote Desktop Manager on Windows are vulnerable to the exposure of credentials via unintended requests. This vulnerability specifically impacts Devolutions Server versions through 2025.3.8.0 and Remote Desktop Manager versions through 2025.3.23.0 . The issue involves an AI...

CVE-2025-13683

Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Server: through 2025.3.8.0; Remote Desktop Manager: through 2025.3.23.0...

CVE-2025-13683

Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Server: through 2025.3.8.0; Remote Desktop Manager: through 2025.3.23.0...