2478 matches found
CVE-2020-35145
Acronis True Image for Windows prior to 2021 Update 3 allowed local privilege escalation due to a DLL hijacking vulnerability in multiple components, aka an Untrusted Search Path issue...
CVE-2020-35145
CVE-2020-35145 affects Acronis True Image for Windows prior to 2021 Update 3, with a DLL hijacking (Untrusted Search Path) local privilege escalation in multiple components. Root cause: untrusted search path; impact: local privilege escalation. Affected versions are prior to 2021 Update 3. Mitiga...
PT-2021-11717
Name of the Vulnerable Software and Affected Versions: Acronis True Image for Windows versions prior to 2021 Update 3 Description: The issue allows local privilege escalation due to a DLL hijacking vulnerability in multiple components, also known as an Untrusted Search Path issue. This means that...
Acronis True Image for Windows 代码问题漏洞
Acronis True Image is a well-known data backup and restore software from Singapore-based Acronis. The software can be used to create drive and disk images and can restore images when a clean system is needed.Acronis True Image for Windows 2021 Update 3 previous versions have a code issue...
CVE-2020-35145: Uncontrolled Search Path Element
Acronis True Image for Windows prior to 2021 Update 3 allowed local privilege escalation due to a DLL hijacking vulnerability in multiple components, aka an Untrusted Search Path issue...
Acronis: Blind SSRF vulnerability on cz.acronis.com
Vulnerability description not provided...
Acronis: Stored XSS in profile page
Summary There is a stored XSS vulnerability in the users profile page. Steps: 1-Go to https://forum.acronis.com , create an user and login 2-Go to profile and edit it 3- enter javascript code in Signature field for exampe use this code in Signature : test 4-send this profile to other users ,or se...
Acronis: Cross Site Scripting (Reflected) on https://www.acronis.cz/
Summary You can post javascript and html code in form fields steps : 1-go to vulnerability link : https://www.acronis.cz/poptavka-acronis/ 2- enter this javascript code "alert1; in form field for xss and enter Test for html injection. Impact Impact 1- Cookie stealing 2- Pishing attacks 3- URL...
Acronis: Acronis True Image 2020 Build 22510 Nonstop Backup Service Unquoted service path (privilege escalation)
Vulnerability description not provided...
Acronis: Cross Site Scripting (Reflected) on https://www.acronis.cz/dotaznik/roadshow-2020/
Vulnerability description not provided...
Acronis: licenses key disclosure
Summary Hi team i found the licenses key stored as cleat text i think it important Steps To Reproduce 1. Go to this link https://dl.acronis.com/u/pdf/workstationlicenses.txt 2.And this link https://dl.acronis.com/u/pdf/serverlicenses.txt 3. You can see all licenses key Impact I think I can use th...
Acronis: Credentials leaked via Github
Vulnerability description not provided...
Acronis: Local Privilege Escalation when updating Acronis True Image
Vulnerability description not provided...
Acronis: SSRF when configuring Website Backup on Acronis Cloud
Hi, I hope everything goes well. I have found a SSRF in https://mc-beta-cloud.acronis.com/ui//backup-console/resources when configuring the backup plan for a website. Summary While I was looking at the functionality of managing backups on websites, I saw that if you specify a local IP where to ge...
Acronis: Local privilege escalation via insecure MSI file
Summary I've found a vulnerability which leads to a local privilege escalation starting from a non-admin user. When True Image client installs it drops 2 MSI files into C:\Windows\Installer folder. Since this folder by default is readable by anyone, a non-admin user can execute commands like...
Acronis: Acronis True Image 2021 (windows) does not validate server hostname on a login TLS connection
Acronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5 for Mac did not properly validate SSL certificate. The issue was assigned CVE-2021-32581. We have seen no signs of the exploitation of this vulnerability...
Acronis: Stored XSS in Acronis Cyber Protect Console
Dear Acronis Security Team, Summary There is a possibility of storing an XSS on the https://mc-beta-cloud.acronis.com/ui/ console. Steps To Reproduce add details for how we can reproduce the issue 1. Login to the console with the given account 2. Go to "Protection" under "PLANS" 3. Click on "Crea...
Acronis: HTTP Request Smuggling on https://consumer.acronis.com
Summary The website https://consumer.acronis.com is vulnerable to HTTP Request Smuggling which can be abused by an attacker to redirect all the users to a malicious website. A redirect can be forced by changing the Host request header using the path /sf but the website will redirect you to...
Acronis: HTTP Request Smuggling on https://promosandbox.acronis.com
Summary The website https://promosandbox.acronis.com is vulnerable to HTTP Request Smuggling which can be abused by an attacker to redirect all the users to a malicious website. A redirect can be forced by changing the Host request header using the path /sf but the website will redirect you to...
Acronis: Acronis True Image (Windows) does not validate server certificate on a TLS connection
Acronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5 for Mac did not implement SSL certificate validation. The issue was assigned CVE-2021-32581. We have seen no signs of the exploitation of this vulnerability...