Acronis: Denial of Service in anti_ransomware_service.exe via logs files

antiransomwareservice.exe keeps a log in a folder where any unprivileged user has write permissions. The logs are generated in a predictable pattern allowing the unprivileged user to create a hardlink from the, not yet created, log file to the antiransomwareservice itself. On reboot, this forces...

Acronis: Local Privilege Escalation in anti_ransomware_service.exe via quarantine

antiransomwareservice.exe includes a functionality to quarantine files which will copy the suspected ransomware file from one directory to another using SYSTEM privileges. As any unprivileged user has write permissions in the quarantine folder, it is possible to control this privileged write with...

Acronis: Open redirect at mc-beta-cloud-acronis.com

Open Redirect Vulnerability Steps To Reproduce: Type in this URL:...

Acronis: Broken Access Controls

The End Point notary.acronis.com Blocks access to the panel if you are not an authenticated user. More is possible to access some functions of the panel by adding the .html at the end See Poc From Video Below Impact Broken access control vulnerabilities exist when a user can in fact access some...

Acronis: Missing rate limit for current password field (Password Change) Account Takeover

Vulnerability: Missing Rate Limit for Current Password field Password Change Account Takeover Steps to reproduce the bug: 1Go to Profile Password. Enter any wrong password In current password filed. 2Now enter the new password and Turn the Intercept ON. 3Capture the request & Send the request to...

Acronis: Accessing repository and other files by directory listing

It was reported that directory listing is possible on https://storage-repo.acronis.com. https://storage-repo.acronis.com is a YUM repository with no sensitive data and it is supposed to be publicly accessible...

Acronis True Image OEM 19.0.5128 Unquoted Service Path

Exploit Title: Acronis True Image OEM 19.0.5128 - 'afcdpsrv' Unquoted Service Path Date: 2019-11-11 Author: Alejandra Sánchez Vendor Homepage: https://www.acronis.com Software: ftp://supportdownload:[email protected]/AcronisTrueImageOEM5128.exe Version: 19.0.5128 Tested on: Windows...

Acronis True Image OEM 19.0.5128 - (afcdpsrv) Unquoted Service Path Vulnerability

Exploit Title: Acronis True Image OEM 19.0.5128 - 'afcdpsrv' Unquoted Service Path Author: Alejandra Sánchez Vendor Homepage: https://www.acronis.com Software: ftp://supportdownload:email protected/AcronisTrueImageOEM5128.exe Version: 19.0.5128 Tested on: Windows 10 Description: Acronis True Imag...

Acronis True Image OEM 19.0.5128 - afcdpsrv Unquoted Service Path

Acronis True Image OEM 19.0.5128 - afcdpsrv Unquoted Service Path Exploit Title: Acronis True Image OEM 19.0.5128 - 'afcdpsrv' Unquoted Service Path Date: 2019-11-11 Author: Alejandra Sánchez Vendor Homepage: https://www.acronis.com Software:...

Acronis True Image OEM 19.0.5128 - 'afcdpsrv' Unquoted Service Path

Exploit Title: Acronis True Image OEM 19.0.5128 - 'afcdpsrv' Unquoted Service Path Date: 2019-11-11 Author: Alejandra Sánchez Vendor Homepage: https://www.acronis.com Software: ftp://supportdownload:[email protected]/AcronisTrueImageOEM5128.exe Version: 19.0.5128 Tested on: Windows...

Acronis: Delete any user's added Email,Telephone,Fax,Address,Skype via csrf in (https://academy.acronis.com/)

The vulnerability allowed an attacker to delete any user's added email, telephone, fax, address, and Skype via CSRF in a GET method without any CSRF protection on the Academy Acronis website. This could be exploited by an attacker to delete sensitive information of any user. The issue was fixed b...

Product update: Virtuozzo Infrastructure Platform 3.0 Update 1.1 (3.0.1-59)

This update provides stability fixes. Vulnerability id: VSTOR-25491 ABGW Acronis Backup Gateway could reject Acronis Backup Advanced certificates. Vulnerability id: VSTOR-25625 S3 NS services could fail to start...

Acronis: Blind XSS on admin.acronis.com via delete account form on account.acronis.com

Blind XSS vulnerability was discovered on admin.acronis.com. The vulnerability could be triggered by sending a payload during the account deletion process on account.acronis.com...

Product update: Virtuozzo Infrastructure Platform 2.5 Update 1 (2.5.0-1599)

This update provides stability and usability fixes. Vulnerability id: VSTOR-19695, VSTOR-19857 Improved automatic firewall rules configuration. Vulnerability id: VSTOR-19909 Unable to register Backup Gateway in Acronis Backup Advanced with an IP address...

Product release: Virtuozzo Infrastructure Platform 2.5

This product is formerly known as Virtuozzo Storage. With this release, Virtuozzo Infrastructure Platform offers a wide range of new features for compute virtualization and software-defined networking, as well as enhancements and stability improvements. It also addresses issues found in the...

Kernel update: New kernel 2.6.32-042stab134.7; Virtuozzo 6.0 Update 12 Hotfix 34 (6.0.12-3728)

This update provides a new kernel 2.6.32-042stab134.7 for Virtuozzo 6.0. The new kernel introduces stability fixes. Vulnerability id: PSBM-89413 Host with multiple ploop devices running on a debug kernel could crash in sysfsaddrmstart on container stop. Vulnerability id: PSBM-89517 In some...

acronis.com XSS vulnerability

Open Bug Bounty ID: OBB-624449 Description| Value ---|--- Affected Website:| acronis.com Open Bug Bounty Program:| View Open Bug Bounty Program Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A...

acronis-cgn.cleverbridge.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-617519 Description| Value ---|--- Affected Website:| acronis-cgn.cleverbridge.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

store.acronis.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-558160 Description| Value ---|--- Affected Website:| store.acronis.com Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Disclosure Standard:| Coordinated Disclosure based on IS...

acronis-s.cleverbridge.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-485291 Description| Value ---|--- Affected Website:| acronis-s.cleverbridge.com Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Disclosure Standard:| Coordinated Disclosure...