CVE-2021-42098

CVE-2021-42098 affects Devolutions Remote Desktop Manager; there is an incomplete permission check on entries prior to version 2021.2.16, allowing permission bypass via batch custom PowerShell. The available connected documents indicate the issue stems from improper access control rather than a v...

CVE-2021-23922

CVE-2021-23922 refers to a cross-site scripting (XSS) vulnerability in Devolutions Remote Desktop Manager (webviews) affecting versions prior to 2020.2.12 . The issue is documented across multiple sources (NVD/CNVD/CVE listings) with CVSS metrics indicating a network-exposed vulnerability, mitiga...

CVE-2022-3182

CVE-2022-3182 affects Devolutions Remote Desktop Manager (DRDM) version 2022.2.14 and earlier, due to an Improper Access Control vulnerability in the Duo SMS two-factor authentication that allows bypassing the application lock. The issue is documented across multiple sources (including Red Hat an...

CVE-2022-4287

The CVE-2022-4287 vulnerability affects Devolutions Remote Desktop Manager for Windows, specifically versions 2022.3.26 and earlier, where an authentication bypass in the local application lock feature allows a malicious user to access the application. The connected documents provide the affected...

CVE-2025-1193

Devolutions Remote Desktop Manager versions 2024.3.19 and earlier on Windows are vulnerable to a trust management issue due to improper host validation in the certificate validation component. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack by presenting a certificate fo...

CVE-2024-7421

The vulnerability CVE-2024-7421 affects Devolutions Remote Desktop Manager (versions up to 2024.2.20.0) on Windows. The issue is an information exposure where credentials used for WinSCP sessions can be retrieved by local attackers who can access system logs, via passwords found in command-line a...

CVE-2022-2221

CVE-2022-2221 concerns an Information Exposure vulnerability in the Devolutions Remote Desktop Manager product. The issue affects versions prior to 2022.1.8 and resides in the My Account Settings area, where authenticated users could access credentials of other users. The connected documents conf...

CVE-2025-1635

The Devolutions Remote Desktop Manager on Windows (versions 2024.3.29 and earlier ) is affected by a security vulnerability (CVE-2025-1635 ) resulting from faulty business logic in the hub data source export feature. This flaw allows an authenticated user to inadvertently include their authentica...

CVE-2022-33995

CVE-2022-33995 describes a path traversal in Devolutions Remote Desktop Manager (RDM) prior to version 2022.2, specifically in the handling of entry attachments. The root cause is a path traversal flaw that could allow an attacker to create or overwrite files in arbitrary locations on the affecte...

CVE-2022-3780

CVE-2022-3780 affects Devolutions Remote Desktop Manager, with the vulnerability arising from deleted users’ database connections staying active on MySQL data sources. This can allow deleted users to access unauthorized data in Remote Desktop Manager 2022.3.7 and prior versions. The issue is docu...

CVE-2025-2528

The Devolutions Remote Desktop Manager on Windows is vulnerable to an improper authorization flaw in the application password policy. This allows an authenticated user to use a configuration that deviates from the rules mandated by system administrators. This issue affects versions 2025.1.24 thro...

CVE-2023-1203

CVE-2023-1203 affects Devolutions Remote Desktop Manager PowerShell Module, Hub Business submodule. The vulnerability stems from improper removal of sensitive data during entry edits, allowing an authenticated user to access sensitive data on entries edited with the affected submodule. Affected v...

CVE-2022-26964

The CVE-2022-26964 entry concerns Devolutions Remote Desktop Manager prior to version 2022.1, where weak password derivation for export enables information disclosure via a password brute-force attack. The underlying issue is an error that causes base64 to be decoded, contributing to the weakness...

CVE-2022-3781

CVE-2022-3781 affects Devolutions Remote Desktop Manager (versions 2022.2.26 and earlier) and Devolutions Server (versions 2022.3.1 and earlier). The root cause is that Dashlane passwords and Keepass Server passwords stored in My Account Settings are not encrypted in the database, allowing databa...

CVE-2025-2600

Devolutions Remote Desktop Manager for Windows contains an improper authorization vulnerability in the variable component. This flaw allows an authenticated user to use the ELEVATED_PASSWORD variable, bypassing the restrictions set by the "Allow password in variable policy" . Affected versions in...

CVE-2021-28047

CVE-2021-28047 affects Devolutions Remote Desktop Manager. The vulnerability is a Cross-Site Scripting (XSS) in Administration Reports present in versions prior to 2021.1, exploitable by a remote authenticated user who can inject arbitrary web script or HTML via multiple input fields. The connect...

CVE-2025-5334

The Devolutions Remote Desktop Manager application contains a vulnerability in the user vaults component that allows authenticated users to gain unauthorized access to private personal information. The root cause is that entries may be unintentionally moved from user vaults to shared vaults when ...

CVE-2023-1202

Devolutions Remote Desktop Manager (RDM) 2023.1.9 and earlier versions are affected by a permission-bypass flaw in the User vault: under ID collision, a user with restricted rights can bypass entry permissions during import or synchronization. The vulnerability affects the ability to control acce...

CVE-2024-11671

Devolutions Remote Desktop Manager versions 2024.3.17 and earlier on Windows are vulnerable to an improper authentication flaw in the SQL data source MFA validation. An authenticated user can bypass Multi-Factor Authentication (MFA) by performing data source switching , potentially leading to una...

CVE-2025-2562

Insufficient logging in the autotyping feature in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a stored password without generating a corresponding log event, via the use of the autotyping functionality. This issue affects Remote Desktop Manager versions from ...

CVE-2024-12149

Devolutions Remote Desktop Manager versions 2024.3.19.0 and earlier on Windows are vulnerable to an incorrect permission assignment within the temporary access requests component . This flaw allows an authenticated user to request temporary permissions on an entry and obtain greater privileges th...

CVE-2024-11672

Devolutions Remote Desktop Manager versions 2024.2.21 and earlier on Windows are affected by an incorrect authorization vulnerability in the add permission component . This flaw allows an authenticated malicious user to bypass the "Add" permission by utilizing the import in vault feature. To reme...

CVE-2025-2499

A client-side access control bypass exists in the permission component of Devolutions Remote Desktop Manager on Windows. An authenticated user can perform specific actions to bypass restrictions on View Password , Edit Asset , and Edit Permissions . Affected versions include 2024.3.29 and earlier...

CVE-2025-1636

Devolutions Remote Desktop Manager version 2024.3.29 and earlier on Windows is vulnerable to a faulty business logic error. This flaw exists in the My Personal Credentials password history component , where an authenticated user can inadvertently leak My Personal Credentials into a shared vault w...

CVE-2024-6055

The Devolutions Remote Desktop Manager software (version 2024.1.32.0 and earlier) on Windows is vulnerable to the improper removal of sensitive information during the data source export process. This flaw occurs because the application fails to scrub certain data before storage or transfer, allow...

CVE-2024-6057

Devolutions Remote Desktop Manager versions 2024.1.31.0 and earlier are affected by an improper authentication vulnerability in the vault password feature. An attacker who has compromised access to an RDM instance can bypass the vault master password by utilizing the offline mode feature. The sev...

CVE-2026-12161

Devolutions Remote Desktop Manager versions 2026.2.5.0 through 2026.2.7.0 and 2026.1.23.0 and earlier are vulnerable to a command injection flaw. The root cause is improper input validation within the SSH Elevate Shell feature. An authenticated user with permissions to create or modify a shared S...

CVE-2024-6354

Devolutions Remote Desktop Manager versions 2024.2.11 and earlier on Windows are affected by an improper access control vulnerability in the PAM dashboard . This flaw allows an authenticated user to bypass the execute permission through the dashboard. As a temporary workaround, it is recommended ...

CVE-2024-11621

Devolutions Remote Desktop Manager is vulnerable to a trust management issue due to missing certificate validation . This flaw allows an attacker to perform a man-in-the-middle (MITM) attack to intercept and modify encrypted communications. Affected versions include macOS 2024.3.9.0 and earlier, ...

CVE-2024-6492

The Devolutions Remote Desktop Manager (versions 2024.2.14.0 and earlier) on Windows is vulnerable to an information exposure flaw in its edge browser session proxy feature . An attacker can leverage a specially crafted website to intercept proxy credentials . As of the provided documentation, th...

CVE-2023-1574

Devolutions Remote Desktop Manager ≤ 2023.1.9 (Windows) has an information-disclosure flaw in the MSSQL user-creation feature: the error dialog reveals the password in clear text when UI access is available. Impact is confidential data exposure with low user interaction, no exploitation vector be...

CVE-2024-2403

CVE-2024-2403 affects Devolutions Remote Desktop Manager prior to 2024.1.12 on Windows. The root cause is improper cleanup in the temporary file handling component, which may allow an attacker who has already compromised a user endpoint to access sensitive information via residual files in the te...

CVE-2023-6593

CVE-2023-6593 concerns a client-side permission bypass in Devolutions Remote Desktop Manager (iOS) 2023.3.4.0 and earlier. According to Red Hat and related sources, an attacker who has access to the application can execute entries in a SQL data source without restriction. The vulnerability is des...

CVE-2024-3545

Devolutions Remote Desktop Manager (version 2024.1.20 and earlier on Windows) and Devolutions Server (version 2024.1.8 and earlier) are vulnerable to improper permission handling within the vault offline cache feature. An attacker who gains access to a computer where the software is installed can...

CVE-2026-12162

The Devolutions Remote Desktop Manager version 2026.2.8 and earlier is affected by an improper host validation vulnerability in its social login autofill feature. An attacker can exploit this by using a crafted web entry that points to a provider lookalike domain , which may lead to the disclosur...

CVE-2023-6288

The CVE-2023-6288 vulnerability affects Devolutions Remote Desktop Manager on macOS (versions 2023.3.9.3 and earlier). The issue is a code injection flaw triggered by the DYLIB_INSERT_LIBRARIES environment variable, enabling a local attacker to execute code. The available references describe the ...

CVE-2025-13683

Devolutions Server and Remote Desktop Manager on Windows are vulnerable to the exposure of credentials in unintended requests . This vulnerability specifically impacts Devolutions Server versions through 2025.3.8.0 and Remote Desktop Manager versions through 2025.3.23.0 . The issue is characteriz...