2155 matches found
Acronis: Large Amounts of Back-End Acronis Source Code is Publicly Accessible
Vulnerability description not provided...
Acronis backup software contains multiple privilege escalation vulnerabilities
Overview Acronis True Image, Cyber Backup, and Cyber Protection all contain privilege escalation vulnerabilities, which can allow an unprivileged Windows user to be able to run arbitrary code with SYSTEM privileges. Description CVE-2020-10138 Acronis Cyber Backup 12.5 and Cyber Protect 15 include...
Acronis: DLL Hijacking when performing operations in Acronis Secure Zone partition leading to Privilege Escalation
Vulnerability description not provided...
Acronis: Possible LDAP username and password disclosed on Github
Summary The file hosted at https://github.com/mlanin/go/blob/3dbd856c3f542c54e512a295ac498c79cd952ed6/.env.testing contains the following information: LDAPDOMAIN=███ LDAPBASEDN=███ LDAPADMINUSER=███████ LDAPADMINPASSWORD=██████ Recommendations Verify if credentials are still in use if so remove t...
Acronis: Local Privilege Escalation via Backup delete
Vulnerability description not provided...
Acronis: Ticket Trick at https://account.acronis.com
Summary Hello dear team, I found a serious issue in Acronis This vulnerability is called ticket trick vulnerability which comes under critical category. Which can allow me to login on websites like atlassian,github,clouflare,choopa,..etc on behalf of [email protected] . Steps To Reprodu...
Acronis: Local Privilege Escalation using System Clean-up functionality
Vulnerability description not provided...
CVE-2020-16171
An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. Some API endpoints on port 9877 under /api/ams/ accept an additional custom Shard header. The value of this header is afterwards used in a separate web request issued by the application itself. This can be abused to conduct...
CVE-2020-16171
An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. Some API endpoints on port 9877 under /api/ams/ accept an additional custom Shard header. The value of this header is afterwards used in a separate web request issued by the application itself. This can be abused to conduct...
Server side request forgery (ssrf)
An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. Some API endpoints on port 9877 under /api/ams/ accept an additional custom Shard header. The value of this header is afterwards used in a separate web request issued by the application itself. This can be abused to conduct...
CVE-2020-16171
An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. Some API endpoints on port 9877 under /api/ams/ accept an additional custom Shard header. The value of this header is afterwards used in a separate web request issued by the application itself. This can be abused to conduct...
EUVD-2020-8137
An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. Some API endpoints on port 9877 under /api/ams/ accept an additional custom Shard header. The value of this header is afterwards used in a separate web request issued by the application itself. This can be abused to conduct...
CVE-2020-16171
CVE-2020-16171 affects Acronis Cyber Backup before 12.5 Build 16342. API endpoints on port 9877 under /api/ams/ accept a Shard header that the application uses to make a separate request, enabling SSRF against localhost-bound services (e.g., NotificationService at 127.0.0.1:30572). The vulnerabil...
Acronis Cyber Backup code issue vulnerability
Acronis Cyber Backup is a data backup product from Acronis Singapore. Acronis Cyber Backup has a code issue vulnerability that can be exploited by attackers to conduct SSRF attack...
Acronis: Local Privilege Escalation when deleting a file from Quarantine
Vulnerability description not provided...
Acronis Cyber Backup 12.5 Build 16341 Server-Side Request Forgery
RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Acronis Cyber Backup Vendor URL: https://www.acronis.com Type: Server-Side Request Forgery CWE-918 Date found: 2020-07-30 Date published: 2020-09-14 CVSSv3 Score: 8.3...
Vulnerability fixed in Acronis Cyber Backup
A vulnerability has been found in Acronis Cyber Backup. A malicious party can exploit the vulnerability to perform a Server-side request-forgery SSRF. This allows the attacker gains access to system data. Acronis has released updates to fix the vulnerability. See the page below for more...
Acronis: XSS in https://promo.acronis.com/
Vulnerability description not provided...