PT-2020-11952

Name of the Vulnerable Software and Affected Versions Acronis True Image version 2021 Description The issue arises from improper ACL settings of the C:ProgramDataAcronis directory by Acronis True Image 2021. This allows an unprivileged user to execute arbitrary code with SYSTEM privileges by...

CVE-2020-10139: Improper Access Control

Acronis True Image 2021 includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkinsagent. Acronis True Image contains a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectories off of the system...

CVE-2020-10138: Improper Access Control

Acronis Cyber Backup 12.5 and Cyber Protect 15 include an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkinsagent. Acronis Cyber Backup and Cyber Protect contain a privileged service that uses this OpenSSL component. Because unprivileged Windows users can...

Acronis True Image Access Control Error Vulnerability

Acronis True Image is a famous data backup and restore software from Acronis Singapore. The software can be used to create drive and disk images and can restore the image when a clean system is needed. Acronis True Image version 2021 suffers from an Access Control Error vulnerability that stems...

Acronis True Image Access Control Error Vulnerability (CNVD-2021-58666)

Acronis True Image is a well-known data backup and restore software from Singapore-based Acronis. The software can be used to create drive and disk images and can restore images when a clean system is needed.Acronis True Image is vulnerable to an access control error that could be exploited by an...

Acronis: XSS Stored in Cacheable response

XSS was possible on https://www.acronis.com due to improper error handling...

Acronis: DLL Hijacking when creating Rescue Media Builder leading to Privilege Escalation

Vulnerability description not provided...

Acronis: DLL Hijacking when sending feedback and crash report leading to Privilege Escalation

Vulnerability description not provided...

Acronis: Large Amounts of Back-End Acronis Source Code is Publicly Accessible

Vulnerability description not provided...

PT-2020-11950

Name of the Vulnerable Software and Affected Versions Acronis Cyber Backup versions 12.5 Acronis Cyber Protect version 15 Description The issue concerns an OpenSSL component in Acronis Cyber Backup and Cyber Protect that specifies an OPENSSLDIR variable as a subdirectory within C:jenkins agent...

Acronis backup software contains multiple privilege escalation vulnerabilities

Overview Acronis True Image, Cyber Backup, and Cyber Protection all contain privilege escalation vulnerabilities, which can allow an unprivileged Windows user to be able to run arbitrary code with SYSTEM privileges. Description CVE-2020-10138 Acronis Cyber Backup 12.5 and Cyber Protect 15 include...

Acronis True Image fails to properly set ACLs of the C:\ProgramData\Acronis directory, which can allow privilege escalation

...

Acronis True Image is vulnerable to privilege escalation via openssl.cnf file

...

Acronis Cyber Backup is vulnerable to privilege escalation via openssl.cnf file

...

Acronis: DLL Hijacking when performing operations in Acronis Secure Zone partition leading to Privilege Escalation

Vulnerability description not provided...

Acronis: Possible LDAP username and password disclosed on Github

Summary The file hosted at https://github.com/mlanin/go/blob/3dbd856c3f542c54e512a295ac498c79cd952ed6/.env.testing contains the following information: LDAPDOMAIN=███ LDAPBASEDN=███ LDAPADMINUSER=███████ LDAPADMINPASSWORD=██████ Recommendations Verify if credentials are still in use if so remove t...

Acronis: Local Privilege Escalation via Backup delete

Vulnerability description not provided...

Acronis: Ticket Trick at https://account.acronis.com

Summary Hello dear team, I found a serious issue in Acronis This vulnerability is called ticket trick vulnerability which comes under critical category. Which can allow me to login on websites like atlassian,github,clouflare,choopa,..etc on behalf of [email protected] . Steps To Reprodu...

Acronis: Local Privilege Escalation using System Clean-up functionality

Vulnerability description not provided...

CVE-2020-16171

An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. Some API endpoints on port 9877 under /api/ams/ accept an additional custom Shard header. The value of this header is afterwards used in a separate web request issued by the application itself. This can be abused to conduct...