Account Confirmation bypass leads to acess some fucntionality #1121132 Informative Access Control Medium 2021-03-30 – 4 Local Privilege Escalation in anti_ransomware_service.exe via quarantine #858598 Valid Access Control Medium 2021-06-24 – 5 Information Disclosure via ZIP file on AWS Bucket [http://acronis.1.s3.amazonaws.com] #1121771 N/A Information Disclosure Medium 2022-02-08 – 5 True Image 2021 - LPE via XPC service communication #966494 Valid Access Control Medium 2021-02-23 $250 6 Unrestricted file upload vulnerability in IMCE #1121317 N/A File and Path Handling Medium 2021-03-16 – 6 Session Fixation on Acronis #1486341 N/A Authentication Medium 2022-03-01 – 6 Local Privilege Escalation via DLL Search-Order Hijacking with Cyber Protection Agent - tibxread.exe utility #963103 Valid Access Control Medium 2024-08-26 – 7 XSS in Acronis Cloud Manager Admin Portal #1388788 Valid Cross-site Scripting Medium 2022-12-02 $100 7 Denial of Service in anti_ransomware_service.exe via logs files #858603 Valid Denial of Service Medium 2021-06-24 – 8 No server side check on terms of service page which leads to bypass #1338256 Duplicate Input Validation and Logic Medium 2021-10-05 – 8 Domain does not Match SSL Certificate #1341142 Valid No weakness recorded Medium 2021-10-05 – 8 Reflected XSS on cz.acronis.com/dekujeme-za-odber-novinek-produktu-disk-director with ability to creating an admin user in WordPress #935503 Valid Cross-site Scripting Medium 2021-06-22 – 9 DLL Hijacking when performing operations in Acronis Secure Zone partition leading to Privilege Escalation #1004740 Valid Access Control Medium 2024-08-26 $250 9 Acronis Sync Agent Service - Untrusted DLL Search-Ordering lead to Privilege Escalation #924493 Valid Access Control Medium 2024-08-26 $250 11 Local Privilege Escalation when deleting a file from Quarantine #983363 Valid Access Control Medium 2024-08-26 $250 11 DLL Hijacking when creating Rescue Media Builder leading to Privilege Escalation #1010552 Valid Access Control Medium 2024-08-27 $250 13 No Rate Limit On Forgot Password Page #1245529 N/A Access Control Medium 2021-07-09 – 13 TrueImage for Acronis True Image 2020 - Untrusted DLL Search-Ordering lead to Privilege Escalation as Administrative account Analysed #959017 Valid Access Control Medium 2024-08-27 $250 14 Acronis True Image Local Privilege Escalation via insecure folder permissions Analysed #908162 Valid Access Control Medium 2021-02-23 $300 15 Arbitrary Files and Folders Deletion vulnerability with Acronis Managed Machine Service Analysed #959815 Valid Access Control Medium 2024-08-27 – 15 Large Amounts of Back-End Acronis Source Code is Publicly Accessible Analysed #1008364 Valid Information Disclosure Medium 2024-08-26 $250 15 DLL Hijacking when sending feedback and crash report leading to Privilege Escalation Analysed #1008427 Valid Access Control Medium 2024-08-27 $250 15 Stored Cross Site Scripting at http://www.grouplogic.com/ADMIN/store/index.cfm?fa=disprocode Analysed #1164853 Valid Cross-site Scripting Medium 2022-06-07 – 15 Store Admin Page Accessible Without Authentication at http://www.grouplogic.com/ADMIN/store/index.cfm Analysed #1164854 Valid Access Control Medium 2022-06-07 $250 15 anti_ransomware_service.exe REST API does not require authentication Analysed #858608 Valid Authentication Medium 2021-06-24 – 17 Cross-site Scripting (XSS) - Stored | forum.acronis.com Analysed #1161241 Valid Cross-site Scripting Medium 2022-02-08 – 20 unauth mosquitto ( client emails, ips, license keys exposure ) Analysed #1578574 Valid Access Control Medium 2022-07-18 $150 20 Account Takeover on unverified emails in File Sync & Share Analysed #906790 Valid Misconfiguration and Insecure Design Medium 2021-06-16 – 21 Local File Disclosure /Delete On [us-az-vpn.acronis.com] Analysed #924407 Valid File and Path Handling Medium 2021-06-22 – 21 Local Privilege Escalation via Backup delete Analysed #1003007 Valid Access Control Medium 2024-08-27 $250 21 Local Privilege Escalation when updating Acronis True Image Analysed #1075449 Valid Access Control Medium 2024-08-27 $250 25 HTML Injection in E-mail Not Resolved () Analysed #1600720 Valid No weakness recorded Medium 2022-07-19 – 25 Cross Origin Resource Sharing Misconfiguration Analysed #958459 Valid Access Control Medium 2023-01-10 – 26 Local Privilege Escalation via DLL Search-Order Hijacking with Cyber Protection Agent - systeminfo.exe utility Analysed #959608 Valid Access Control Medium 2024-08-27 – 26 Credentials leaked via Github Analysed #1078373 Valid Authentication Medium 2024-08-26 $50 26 XSS Stored in Cacheable response Analysed #1011093 Valid Cross-site Scripting Medium 2021-09-05 – 28 Web cache poisoning at www.acronis.com Analysed #1010858 Valid Misconfiguration and Insecure Design Medium 2021-06-17 – 29 Read-only administrator can change agent update settings Analysed #1538004 Valid Access Control Medium 2022-08-10 $200 29 XSS in (Support Requests) : User Cases Analysed #961226 Valid Cross-site Scripting Medium 2021-06-24 $50 30 Local Privilege Escalation and Code Execution when restoring files from Quarantine Analysed #980500 Valid Access Control Medium 2024-08-27 $250 30 Possible LDAP username and password disclosed on Github Analysed #1004412 Valid Information Disclosure Medium 2021-08-17 – 36 CSS Injection via Client Side Path Traversal + Open Redirect leads to personal data exfiltration on Acronis Cloud Analysed #1245165 Valid Cross-site Scripting Medium 2022-11-04 – 37 Reflected XSS via "Error" parameter on https://admin.acronis.com/admin/su/ Analysed #970878 Valid Cross-site Scripting Medium 2021-07-19 $50 39 Missing rate limit for current password field (Password Change) Account Takeover Analysed #827484 Valid Authentication Medium 2020-10-06 – 44 Stored XSS in profile page Analysed #1084183 Valid Cross-site Scripting Medium 2021-11-14 $50 45 admin password disclosure via log file Analysed #1121972 Valid Information Disclosure Medium 2021-12-21 $100 45 IDOR on www.acronis.com API lead to steal private business user information Analysed #1182465 Valid Insecure Direct Object Reference Medium 2021-08-31 $100 48 Blind SSRF vulnerability on cz.acronis.com Analysed #1086206 Valid Server-Side Request Forgery Medium 2024-08-27 – 53 Stored XSS in Acronis Cyber Protect Console Analysed #1064095 Valid Cross-site Scripting Medium 2021-06-10 $500 63 Potential XSS in redirect_url Parameter Analysed #2653342 Valid Cross-site Scripting Medium 2024-11-06 – 64