Acronis: Cross-site Scripting (XSS) - Stored | forum.acronis.com

Summary There is an XSS vulnerability in the search function of the forum forum.acronis.com. Steps To Reproduce 1. Modify your own forum Nickname, add the following payload after the original nickname: alert0 2. Fill in your nickname in the Author form of the search function and wait for the...

Acronis: Reflected XSS on www.acronis.com/de-de/my/subscriptions/index.html

Vulnerability description not provided...

Acronis: Stored Cross-site Scripting on devicelock.com/forum/

Summary Hello, @acronis Team I hope you all doing well. I just found A Stored Cross-site Scripting on devicelock.com/forum/ by changing the City value on https://www.devicelock.com/bitrix/admin/useredit.php? to HTML/javascript code and lead to Stored Cross-site Scripting. 1. go to...

Acronis: admin password disclosure via log file

Hi I have log file disclose admin password on https://www.devicelock.com/log.txt u can see md5 password in log file , 2020-03-20 08:12:15 - main - Module: change password 4.1.2changepassword=yes;/forum/forumauth.php;login=admin;md5=2bca2f877b7a727861b59f4a4039d2e9 Impact this information admin...

Acronis: Information Disclosure via ZIP file on AWS Bucket [http://acronis.1.s3.amazonaws.com]

Summary Hello, @acronis Team I hope you all doing well. during My recon, I found OPEN S3 BUCKET http://acronis.1.s3.amazonaws.com and this BUCKET has an ZIP file . and this file contains sensitive information about the internal system of Acronis. This Zip file Is from 2018. And it looks like it w...

Acronis: Unrestricted file upload vulnerability in IMCE

Summary Steps To Reproduce POC 1. Go to "https://forum.acronis.com/" and creat user 1. Click on edit profile and go to Signature click on inser image usig imce file manger 1. Now upload php file and bypass to add .gif in the endpoint Recommendations...

Acronis: Account Confirmation bypass leads to acess some fucntionality

STEPS: 1. Go to the URL https://account.acronis.com//auth/signup 2. Create a Business Account 3. Intercept the request using burp suite 4. Now intercept the response of given HTTP REQUEST below 5. Change the field "confirmed":false to true 6. Even you can bypass Accept term condition by changing...

Acronis Cyber Protect Cross-Site Scripting Vulnerability

Acronis Cyber Protect is an application. Acronis Cyber Protect 15 Update 1 build 26172 has a cross-site scripting vulnerability that stems from cross-site scripting XSS in the console. . No detailed vulnerability details are available at this time...

Acronis Cyber Protect Access Control Error Vulnerability

Acronis Cyber Protect is an application. providing unified user network protection by integrating backup, disaster recovery, artificial intelligence-based malware protection, remote assistance and security into a single, reliable tool.Acronis Cyber Protect 15 Update 1 build 2617 Previous versions...

Acronis: SQL injection in https://www.acronis.cz/ via the log parameter

I have discovered a SQL injection in https://www.acronis.cz/ using the POST request via the log parameter. Using sqlmap, I have retrieved the current user: 'uacronis@localhost'' The command used: sqlmap -p log -r request-cz.txt --current-user --level=2 --risk=2 I did not perform any other actions...

CVE-2020-35556

An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. Because the local notification service misconfigures CORS, information disclosure can occur...

CVE-2020-35556

An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. Because the local notification service misconfigures CORS, information disclosure can occur...

CVE-2020-35664

An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. There is cross-site scripting XSS in the console...

CVE-2020-35664

An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. There is cross-site scripting XSS in the console...

Cross site scripting

An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. There is cross-site scripting XSS in the console...

Information disclosure

An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. Because the local notification service misconfigures CORS, information disclosure can occur...

CVE-2020-35556

CVE-2020-35556 affects Acronis Cyber Protect before 15 Update 1 build 26172. The root cause is a misconfigured CORS policy in the local notification service, enabling information disclosure. Documents consistently cite potential exposure but do not provide specific exploit details, affected subco...

CVE-2020-35556

An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. Because the local notification service misconfigures CORS, information disclosure can occur...

CVE-2020-35664

An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. There is cross-site scripting XSS in the console...

CVE-2020-35664

CVE-2020-35664 : Multiple sources (NVD, Red Hat, CNVD, CVE lists) report an XSS vulnerability in Acronis Cyber Protect prior to 15 Update 1, build 26172, specifically in the console. The exact root cause, affected components, exploit methods, and remediation steps are not detailed in the provided...