Devolutions Security Vulnerabilities

CVE-2023-6588

Offline mode is always enabled, even if permission disallows it, inDevolutions Server data source in Devolutions Workspace 2023.3.2.0 andearlier. This allows an attacker with access to the Workspaceapplication to access credentials when offline.

CVE-2023-6593

Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the application to execute entries in a SQL data source without restriction.

CVE-2023-7047

Inadequate validation of permissions when employing remote tools andmacros via the context menu within Devolutions Remote Desktop Manager versions 2023.3.31 andearlier permits a user to initiate a connection without proper executionrights via the remote tools feature. This affects only SQL data sou...

CVE-2024-0589

Cross-site scripting (XSS) vulnerability in the entry overview tab in Devolutions Remote Desktop Manager 2023.3.36 and earlier on Windows allows an attacker with access to a data source to inject a malicious script via a specially crafted input in an entry.