ClickJacking #947690 N/A Misconfiguration and Insecure Design – 2021-03-16 – 2 Subdomains takeover of register.acronis.com, promo.acronis.com, info.acronis.com and promosandbox.acronis.com #1018790 N/A Access Control – 2022-02-08 – 2 Found multiple SAP NetWeaver vulnerable services #1103212 Duplicate No weakness recorded – 2021-02-16 – 2 CVE-2020-6287 https://redapi2.acronis.com #1028392 N/A Access Control – 2021-02-16 – 3 Account Confirmation bypass leads to acess some fucntionality #1121132 Informative Access Control – 2021-03-30 – 4 Reflected Cross Site Scripting at ColdFusion Debugging Panel http://www.grouplogic.com/CFIDE/debug/cf_debugFr.cfm #1166918 Valid Cross-site Scripting – 2022-06-14 – 4 Local Privilege Escalation in anti_ransomware_service.exe via quarantine #858598 Valid Access Control – 2021-06-24 – 5 Local Privilege Escalation via EXE hijacking with Acronis True Image 2021 installer #970739 Valid Access Control Low 2024-08-27 – 5 Information Disclosure via ZIP file on AWS Bucket [http://acronis.1.s3.amazonaws.com] #1121771 N/A Information Disclosure – 2022-02-08 – 5 Reflected Cross Site Scripting at http://www.grouplogic.com/files/glidownload/verify3.asp [Uppercase Filter Bypass] #1167034 Valid Cross-site Scripting – 2022-06-14 – 5 True Image 2021 - LPE via XPC service communication #966494 Valid Access Control – 2021-02-23 $250 6 Unrestricted file upload vulnerability in IMCE #1121317 N/A File and Path Handling – 2021-03-16 – 6 Session Fixation on Acronis #1486341 N/A Authentication – 2022-03-01 – 6 Local Privilege Escalation via DLL Search-Order Hijacking with Cyber Protection Agent - tibxread.exe utility #963103 Valid Access Control Medium 2024-08-26 – 7 Local Privilege Escalation via EXE hijacking with Acronis True Image 2021 - Acronis Scheduler2 Service #971610 Valid Access Control Low 2024-08-27 – 7 Self-DoS due to template injection via email field in password reset form on access.acronis.com #1265344 Informative No weakness recorded – 2022-05-03 – 7 XSS in Acronis Cloud Manager Admin Portal #1388788 Valid Cross-site Scripting – 2022-12-02 $100 7 Content Spoofing #841630 Valid Input Validation and Logic – 2020-08-12 – 8 Denial of Service in anti_ransomware_service.exe via logs files #858603 Valid Denial of Service – 2021-06-24 – 8 Acronis True Image Local Privilege Escalation Due To Race Condition In Application Verification #1251464 Valid Access Control – 2022-07-28 – 8 No server side check on terms of service page which leads to bypass #1338256 Duplicate Input Validation and Logic – 2021-10-05 – 8 Domain does not Match SSL Certificate #1341142 Valid No weakness recorded – 2021-10-05 – 8 Reflected XSS on cz.acronis.com/dekujeme-za-odber-novinek-produktu-disk-director with ability to creating an admin user in WordPress #935503 Valid Cross-site Scripting – 2021-06-22 – 9 DLL Hijacking when performing operations in Acronis Secure Zone partition leading to Privilege Escalation #1004740 Valid Access Control Medium 2024-08-26 $250 9 Get ip and Geo location any user via Clickjacking with inspectlet technology #998555 Duplicate Information Disclosure – 2020-10-15 – 10 Acronis Sync Agent Service - Untrusted DLL Search-Ordering lead to Privilege Escalation #924493 Valid Access Control Medium 2024-08-26 $250 11 Arbitrary DLL injection in mmsminisrv (Acronis Managed Machine Service Mini) #944735 Valid Access Control – 2020-10-20 – 11 No brute force protection on web-api-cloud.acronis.com #972045 Valid Authentication – 2021-06-24 $100 11 Local Privilege Escalation when deleting a file from Quarantine #983363 Valid Access Control Medium 2024-08-26 $250 11 Open redirect at mc-beta-cloud-acronis.com #846389 Valid Open Redirect – 2022-11-15 – 12 HTTP Request Smuggling on https://promosandbox.acronis.com #1063493 Valid Injection and Smuggling – 2021-11-16 – 12 DLL Hijacking when creating Rescue Media Builder leading to Privilege Escalation #1010552 Valid Access Control Medium 2024-08-27 $250 13 No Rate Limit On Forgot Password Page #1245529 N/A Access Control – 2021-07-09 – 13 TrueImage for Acronis True Image 2020 - Untrusted DLL Search-Ordering lead to Privilege Escalation as Administrative account #959017 Valid Access Control Medium 2024-08-27 $250 14 Acronis True Image Local Privilege Escalation via insecure folder permissions #908162 Valid Access Control – 2021-02-23 $300 15 Subdomain Takeover – jet.acronis.com pointing to unclaimed Webflow services #952166 Valid Access Control – 2021-06-18 – 15 Arbitrary Files and Folders Deletion vulnerability with Acronis Managed Machine Service #959815 Valid Access Control Medium 2024-08-27 – 15 Large Amounts of Back-End Acronis Source Code is Publicly Accessible #1008364 Valid Information Disclosure Medium 2024-08-26 $250 15 DLL Hijacking when sending feedback and crash report leading to Privilege Escalation #1008427 Valid Access Control Medium 2024-08-27 $250 15 Stored Cross Site Scripting at http://www.grouplogic.com/ADMIN/store/index.cfm?fa=disprocode #1164853 Valid Cross-site Scripting – 2022-06-07 – 15 Store Admin Page Accessible Without Authentication at http://www.grouplogic.com/ADMIN/store/index.cfm #1164854 Valid Access Control – 2022-06-07 $250 15 HTTP Request Smuggling on https://consumer.acronis.com #1063627 Valid Injection and Smuggling – 2021-11-16 – 16 Missing brute force protection on login page on www.acronis.com #1435392 Valid Authentication – 2023-08-30 $250 16 anti_ransomware_service.exe REST API does not require authentication #858608 Valid Authentication – 2021-06-24 – 17 Acronis True Image 2020 Build 22510 Nonstop Backup Service Unquoted service path (privilege escalation) #1083532 Valid Access Control Low 2024-08-27 – 17 Acronis True Image 2021 (windows) does not validate server hostname on a login TLS connection #1070533 Valid Cryptography – 2021-08-10 $250 18 Broken Access Controls #833735 Valid Access Control – 2021-02-09 – 19 Subdomain Takeover – www.jet.acronis.com pointing to unclaimed Webflow services #953719 Valid Access Control – 2021-06-18 – 19 DOM based XSS in store.acronis.com/<id>/purl-corporate-standard-IT [cfg parameter] #968690 Valid No weakness recorded – 2020-10-20 $50 19 Clickjacking on cas.acronis.com login page #971234 Valid Misconfiguration and Insecure Design – 2020-11-03 – 19