acronis.com XSS vulnerability

Open Bug Bounty ID: OBB-369663 Description| Value ---|--- Affected Website:| acronis.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

The vulnerability of the Acronis True Image backup and recovery software relates to security configuration errors during updates via HTTP. This allows a malicious actor to execute arbitrary code with administrator privileges.

The vulnerability of the Acronis True Image backup and recovery software relates to security configuration errors during updates via HTTP. In such updates, only those updates that use the MD5 hash provided by the server are verified. Exploiting this vulnerability allows an attacker to execute...

Advantech SUSIAccess 3.0 File Upload

! /usr/bin/env ruby =begin Exploit Title: Advantech SUSIAccess RecoveryMgmt File Upload Date: 07/31/17 Exploit Author: james fitts Vendor Homepage: http://www.advantech.com/ Version: Advantech SUSIAccess = 3.0 Tested on: Windows 7 SP1 Relavant Advisories: ZDI-16-630 ZDI-16-628 CVE-2016-9349...

CVE-2017-3219

Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash...

Code injection

Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash...

CVE-2017-3219

Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash...

CVE-2017-3219

Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash...

CVE-2017-3219

CVE-2017-3219 affects Acronis True Image up to 2017 Build 8053, which performs software updates over HTTP with updates only verified by a server-provided MD5 hash. This design allows a potential attacker on the same network or able to influence traffic to cause the update process to execute arbit...

CVE-2017-3219: Missing Encryption of Sensitive Data

Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash...

Acronis True Image Man-in-the-Middle Bypass Security Vulnerability

Acronis True Image is a disaster backup and recovery solution from Acronis Switzerland. The solution supports backing up, synchronizing, sharing and storing various types of files. A security vulnerability exists in Acronis True Image that stems from the program's failure to securely detect and...

Acronis True Image fails to update itself securely

Overview Acronis True Image fails to securely check for and retrieve updates, which an allow an authenticated attacker to execute arbitrary code with administrator privileges. Description Acronis True Image is a disk backup utility for Windows and Mac systems. Acronis True Image versions through...

PT-2017-2869

Name of the Vulnerable Software and Affected Versions Acronis True Image versions up to and including 2017 Build 8053 Description The issue is related to errors in security settings when updating using HTTP, where downloaded updates are only verified using a server-provided MD5 hash. This could...

Acronis Backup - Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Acronis Backup published at the 'play' market has multiple vulnerabilities...

Acronis Access - Customized SSL, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Acronis Access published at the 'play' market has multiple vulnerabilities...

Acronis True Image: Backup App - Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Acronis True Image: Backup App published at the 'play' market has multiple vulnerabilities...

acronis pxe server 2.0.0.1076 - Directory Traversal / null pointer vulns

No description provided by source. Luigi Auriemma Application: Acronis PXE Server http://www.acronis.com/enterprise/products/snapdeploy/ Versions: = 2.0.0.1076 Platforms: Windows Bugs: A directory traversal B NULL pointer Exploitation: remote Date: 08 Mar 2008 Author: Luigi Auriemma e-mail:...

Acronis True Image Echo Enterprise Server 9.5.0.8072 - Multiple Remote Denial of Service Vulnerabilities

No description provided by source...

CVE-2008-3671

Acronis True Image Echo Server 9.x build 8072 on Linux does not properly encrypt backups to an FTP server, which allows remote attackers to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Information disclosure

Acronis True Image Echo Server 9.x build 8072 on Linux does not properly encrypt backups to an FTP server, which allows remote attackers to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-3671

The CVE-2008-3671 entry concerns Acronis True Image Echo Server 9.x build 8072 running on Linux, where backups sent to an FTP server are not properly encrypted. This leads to potential information disclosure by remote attackers. The vulnerability description notes that the provenance is unknown a...