CVE-2022-3405

CVE-2022-3405 affects Acronis Cyber Protect 15 (Windows, Linux) before build 29486 and Acronis Cyber Backup 12.5 (Windows, Linux) before build 16545, caused by excessive privileges granted to the Acronis Agent which enables code execution and sensitive information disclosure. Public disclosures i...

CVE-2022-30995

CVE-2022-30995 affects Acronis Cyber Protect 15 (Windows, Linux) before build 29486 and Acronis Cyber Backup 12.5 (Windows, Linux) before build 16545. The root cause is an improper authentication flow that leads to sensitive information disclosure. Public sources (NVD, Red Hat, CIRCL/CVE data) de...

CVE-2020-10138

CVE-2020-10138 affects Acronis Cyber Backup 12.5 and Cyber Protect 15, where an OpenSSL component uses an OPENSSLDIR in C:\jenkins_agent\ and a privileged service exposes a local path traversal/vector. Unprivileged Windows users can create directories off the system root to point an openssl.cnf a...

CVE-2020-16171

CVE-2020-16171 affects Acronis Cyber Backup before 12.5 Build 16342. API endpoints on port 9877 under /api/ams/ accept a Shard header that the application uses to make a separate request, enabling SSRF against localhost-bound services (e.g., NotificationService at 127.0.0.1:30572). The vulnerabil...