CVE-2023-4373

CVE-2023-4373 concerns Devolutions Remote Desktop Manager (versions ≤ 2023.2.19). The issue is inadequate validation of permissions when using remote tools and macros, allowing a user to initiate a connection without proper execution rights via the remote tools feature. Affected software: Devolut...

CVE-2023-1203

CVE-2023-1203 affects Devolutions Remote Desktop Manager PowerShell Module, Hub Business submodule. The vulnerability stems from improper removal of sensitive data during entry edits, allowing an authenticated user to access sensitive data on entries edited with the affected submodule. Affected v...

CVE-2023-5766

CVE-2023-5766 affects Devolutions Remote Desktop Manager, with vulnerable versions 2023.2.33 and earlier on Windows. The issue allows remote code execution from another Windows user session on the same host via a specially crafted TCP packet. This is a network-based vulnerability, with the descri...

CVE-2023-1202

Devolutions Remote Desktop Manager (RDM) 2023.1.9 and earlier versions are affected by a permission-bypass flaw in the User vault: under ID collision, a user with restricted rights can bypass entry permissions during import or synchronization. The vulnerability affects the ability to control acce...

CVE-2023-0463

CVE-2023-0463 affects Devolutions Remote Desktop Manager 2022.3.29–2022.3.30. The root cause is that the force offline MFA prompt setting is not respected when switching to offline mode, allowing a user to save sensitive data on disk. Impact: local compromise of data confidentiality, integrity, a...

CVE-2023-4417

The CVE-2023-4417 issue affects Devolutions Remote Desktop Manager for Windows up to 2023.2.19, caused by improper access controls in the entry duplication component. An authenticated user can, under certain conditions, share a personal vault entry with shared vaults via an incorrect vault during...

CVE-2023-1574

Devolutions Remote Desktop Manager ≤ 2023.1.9 (Windows) has an information-disclosure flaw in the MSSQL user-creation feature: the error dialog reveals the password in clear text when UI access is available. Impact is confidential data exposure with low user interaction, no exploitation vector be...

CVE-2023-1980

CVE-2023-1980: Devolutions Remote Desktop Manager (versions ≤ 2022.3.35) contains a two-factor authentication bypass that lets an attacker cancel 2FA via the application UI and access entries. The vulnerability is evidenced in multiple databases (NVD, CVE listings) with a CVSSv3.1 base score of 6...

CVE-2023-5765

The CVE-2023-5765 entry concerns Devolutions Remote Desktop Manager (Windows) with versions 2023.2.33 and earlier, where an improper access control in the password analyzer allows bypassing permissions via data source switching. Exploitation details are not provided in the documents, and the core...

CVE-2023-6593

CVE-2023-6593 concerns a client-side permission bypass in Devolutions Remote Desktop Manager (iOS) 2023.3.4.0 and earlier. According to Red Hat and related sources, an attacker who has access to the application can execute entries in a SQL data source without restriction. The vulnerability is des...

CVE-2023-1939

CVE-2023-1939 concerns a lack of access control for the OTP key on OTP entries in Devolutions Remote Desktop Manager. Affected products: Windows 2022.3.33.0 and prior; Linux 2022.3.2.0 and prior. Impact: non-admin users can view OTP keys via the user interface. Root cause: insufficient authorizat...

CVE-2023-7047

The CVE-2023-7047 entry concerns Devolutions Remote Desktop Manager. Affected software: Devolutions Remote Desktop Manager versions 2023.3.31 and earlier. Root cause: inadequate validation of permissions when using remote tools and macros via the context menu. Impact: a user could initiate a conn...

CVE-2023-2282

Devolutions Remote Desktop Manager suffers improper access control in the Web Login listener (affecting 2023.1.22 and earlier). An authenticated user can bypass administrator-imposed Web Login restrictions and access restricted entries via an unexpected vector. The NVD CVE entry lists a MEDIUM/LO...

CVE-2023-6288

The CVE-2023-6288 vulnerability affects Devolutions Remote Desktop Manager on macOS (versions 2023.3.9.3 and earlier). The issue is a code injection flaw triggered by the DYLIB_INSERT_LIBRARIES environment variable, enabling a local attacker to execute code. The available references describe the ...