CVE-2024-6354

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the execute permission via the use of the PAM dashboard.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1262

Affected software

No affected versions have been published.

Timeline

Published: Jun 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-63554.3A vulnerability was found in Genexis Tilgin Fiber Home Gateway HG1522 CSx000-01_09_01_12. It has been declared as problematic. Affected by t CVE-2024-63564.4An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and star CVE-2024-63578.8Insecure Direct Object Reference vulnerability identified in OpenText ArcSight Intelligence.CVE-2024-63588.8Incorrect Authorization vulnerability identified in OpenText ArcSight Intelligence.CVE-2024-63599.8Privilege escalation vulnerability identified in OpenText ArcSight Intelligence.CVE-2024-63609.8Incorrect Permission Assignment for Critical Resource vulnerability in OpenText™ Vertica could allow Privilege Abuse and result in unauthori CVE-2024-63615.4Improper Neutralization vulnerability (XSS) has been discovered in OpenText™ ALM Octane. The vulnerability affects all version prior to vers CVE-2024-63624.6The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting the CVE-2024-63635.4The Stock Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock_ticker shortcode in all versions u CVE-2024-63646.4A vulnerability in Absolute Persistence® versions before 2.8 exists when it is not activated. This may allow a skilled attacker with both ph CVE-2024-63659.8The Product Table by WBW plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'sa CVE-2024-63669.1The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media