Acronis: Local Privilege Escalation when deleting a file from Quarantine

Vulnerability description not provided...

Acronis Cyber Backup 12.5 Build 16341 Server-Side Request Forgery

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Acronis Cyber Backup Vendor URL: https://www.acronis.com Type: Server-Side Request Forgery CWE-918 Date found: 2020-07-30 Date published: 2020-09-14 CVSSv3 Score: 8.3...

Vulnerability fixed in Acronis Cyber Backup

A vulnerability has been found in Acronis Cyber Backup. A malicious party can exploit the vulnerability to perform a Server-side request-forgery SSRF. This allows the attacker gains access to system data. Acronis has released updates to fix the vulnerability. See the page below for more...

Acronis: XSS in https://promo.acronis.com/

Vulnerability description not provided...

Acronis: Local Privilege Escalation and Code Execution when restoring files from Quarantine

Vulnerability description not provided...

Acronis: No brute force protection on web-api-cloud.acronis.com

There was no brute force protection on https://web-api-cloud.acronis.com/api/idp/v1/token endpoint...

Acronis: Local Privilege Escalation via EXE hijacking with Acronis True Image 2021 - Acronis Scheduler2 Service

Vulnerability description not provided...

Acronis: Clickjacking on cas.acronis.com login page

Steps To Reproduce: Create a new HTML file Source code: I Frame Clickjacking Vulnerability Save the file as whatever.html Open document in browser Reference: https://hackerone.com/reports/591432 FIX- The vulnerability can be fixed by adding "frame-ancestors 'self';" to the CSP...

Acronis: Local Privilege Escalation via EXE hijacking with Acronis True Image 2021 installer

Vulnerability description not provided...

Acronis: True Image 2021 - LPE via XPC service communication

Summary This is a follow up of 908152. The bug reported there wasn't fixed properly, and as you don't see it, I consider this as new. In the good faith that you will not close this as duplicate submitting this. Also hoping for a bit more bounty than the 200$... The privilege helper tool only...

Acronis: mysql credentials exposed on - https://cz.acronis.com/docker-compose.yml

Hi, there are some MySQL credentials exposed on https://cz.acronis.com/docker-compose.yml It is not that you are gonna avoid a compromise with that user/password pair, but just in case you don't wanna make it even easier publishing the credentials to the wild x Impact MySQL credentials exposed...

Acronis: Local Privilege Escalation via DLL Search-Order Hijacking with Cyber Protection Agent - tibxread.exe utility

Vulnerability description not provided...

Acronis: SQL Injection in agent-manager

1.https://mc-beta-cloud.acronis.com/api/agentmanager/v2/unitconfigurations?name=update-schedule&nodata=false&tenantid=1590228&unit=atp-agent%27and%2F%2A%2A%2Fextractvalue%281%2Cconcat%28char%28126%29%2C%28select+database%28%29%29%29%29and%27...

Acronis: CSRF and XSS on www.acronis.com

Vulnerability description not provided...

Acronis: XSS in (Support Requests) : User Cases

Stored XSS was possible on https://www.acronis.com/en-us/my/cases/index.html via support case sent to https://support.acronis.com...

Acronis: Stored XSS in backup scanning plan name

Dear Acronis Security Team, Summary: There is a possibility of storing an XSS on the https://mc-beta-cloud.acronis.com/ui/ console. Steps To Reproduce: 1. Login to the console with the given account 2. Go to "Backup Scanning" under "PLANS" 3. Click on "Create Plan" 4. Specify the location of the...

Acronis: Arbitrary Files and Folders Deletion vulnerability with Acronis Managed Machine Service

Vulnerability description not provided...

Acronis: TrueImage for Acronis True Image 2020 - Untrusted DLL Search-Ordering lead to Privilege Escalation as Administrative account

Vulnerability description not provided...

Acronis: Self XSS on Acronis Cyber Cloud

Self-XSS was possible in Cyber Protect Console via backup plan name...

Acronis: Subdomain Takeover – www.jet.acronis.com pointing to unclaimed Webflow services

Hi Team, Greetings! I've come across another subdomainwww.jet.acronis.com of acronis.com pointing to an unclaimed Webflow service. Visiting the www.jet.acronis.com returned the default 404 page for Webflow service, thereby making it potential for subdomain takeover. F940499 Similar to the previou...