Reflected Cross Site Scripting at ColdFusion Debugging Panel http://www.grouplogic.com/CFIDE/debug/cf_debugFr.cfm #1166918 Valid Cross-site Scripting Low 2022-06-14 – 4 Local Privilege Escalation in anti_ransomware_service.exe via quarantine #858598 Valid Access Control Medium 2021-06-24 – 5 Local Privilege Escalation via EXE hijacking with Acronis True Image 2021 installer #970739 Valid Access Control Low 2024-08-27 – 5 Reflected Cross Site Scripting at http://www.grouplogic.com/files/glidownload/verify3.asp [Uppercase Filter Bypass] #1167034 Valid Cross-site Scripting Low 2022-06-14 – 5 True Image 2021 - LPE via XPC service communication #966494 Valid Access Control Medium 2021-02-23 $250 6 Local Privilege Escalation via DLL Search-Order Hijacking with Cyber Protection Agent - tibxread.exe utility #963103 Valid Access Control Medium 2024-08-26 – 7 Local Privilege Escalation via EXE hijacking with Acronis True Image 2021 - Acronis Scheduler2 Service #971610 Valid Access Control Low 2024-08-27 – 7 XSS in Acronis Cloud Manager Admin Portal #1388788 Valid Cross-site Scripting Medium 2022-12-02 $100 7 Content Spoofing #841630 Valid Input Validation and Logic None 2020-08-12 – 8 Denial of Service in anti_ransomware_service.exe via logs files #858603 Valid Denial of Service Medium 2021-06-24 – 8 Acronis True Image Local Privilege Escalation Due To Race Condition In Application Verification #1251464 Valid Access Control High 2022-07-28 – 8 Domain does not Match SSL Certificate #1341142 Valid No weakness recorded Medium 2021-10-05 – 8 Reflected XSS on cz.acronis.com/dekujeme-za-odber-novinek-produktu-disk-director with ability to creating an admin user in WordPress #935503 Valid Cross-site Scripting Medium 2021-06-22 – 9 DLL Hijacking when performing operations in Acronis Secure Zone partition leading to Privilege Escalation #1004740 Valid Access Control Medium 2024-08-26 $250 9 Acronis Sync Agent Service - Untrusted DLL Search-Ordering lead to Privilege Escalation #924493 Valid Access Control Medium 2024-08-26 $250 11 Arbitrary DLL injection in mmsminisrv (Acronis Managed Machine Service Mini) #944735 Valid Access Control High 2020-10-20 – 11 No brute force protection on web-api-cloud.acronis.com #972045 Valid Authentication Low 2021-06-24 $100 11 Local Privilege Escalation when deleting a file from Quarantine #983363 Valid Access Control Medium 2024-08-26 $250 11 Open redirect at mc-beta-cloud-acronis.com #846389 Valid Open Redirect None 2022-11-15 – 12 HTTP Request Smuggling on https://promosandbox.acronis.com #1063493 Valid Injection and Smuggling Low 2021-11-16 – 12 DLL Hijacking when creating Rescue Media Builder leading to Privilege Escalation #1010552 Valid Access Control Medium 2024-08-27 $250 13 TrueImage for Acronis True Image 2020 - Untrusted DLL Search-Ordering lead to Privilege Escalation as Administrative account #959017 Valid Access Control Medium 2024-08-27 $250 14 Acronis True Image Local Privilege Escalation via insecure folder permissions #908162 Valid Access Control Medium 2021-02-23 $300 15 Subdomain Takeover – jet.acronis.com pointing to unclaimed Webflow services #952166 Valid Access Control Low 2021-06-18 – 15 Arbitrary Files and Folders Deletion vulnerability with Acronis Managed Machine Service #959815 Valid Access Control Medium 2024-08-27 – 15 Large Amounts of Back-End Acronis Source Code is Publicly Accessible #1008364 Valid Information Disclosure Medium 2024-08-26 $250 15 DLL Hijacking when sending feedback and crash report leading to Privilege Escalation #1008427 Valid Access Control Medium 2024-08-27 $250 15 Stored Cross Site Scripting at http://www.grouplogic.com/ADMIN/store/index.cfm?fa=disprocode #1164853 Valid Cross-site Scripting Medium 2022-06-07 – 15 Store Admin Page Accessible Without Authentication at http://www.grouplogic.com/ADMIN/store/index.cfm #1164854 Valid Access Control Medium 2022-06-07 $250 15 HTTP Request Smuggling on https://consumer.acronis.com #1063627 Valid Injection and Smuggling Low 2021-11-16 – 16 Missing brute force protection on login page on www.acronis.com #1435392 Valid Authentication – 2023-08-30 $250 16 anti_ransomware_service.exe REST API does not require authentication #858608 Valid Authentication Medium 2021-06-24 – 17 Acronis True Image 2020 Build 22510 Nonstop Backup Service Unquoted service path (privilege escalation) #1083532 Valid Access Control Low 2024-08-27 – 17 Acronis True Image 2021 (windows) does not validate server hostname on a login TLS connection #1070533 Valid Cryptography High 2021-08-10 $250 18 Broken Access Controls #833735 Valid Access Control None 2021-02-09 – 19 Subdomain Takeover – www.jet.acronis.com pointing to unclaimed Webflow services #953719 Valid Access Control Low 2021-06-18 – 19 DOM based XSS in store.acronis.com/<id>/purl-corporate-standard-IT [cfg parameter] #968690 Valid No weakness recorded Low 2020-10-20 $50 19 Clickjacking on cas.acronis.com login page #971234 Valid Misconfiguration and Insecure Design Low 2020-11-03 – 19 CVE-2021-40438 on cp-eu2.acronis.com #1370731 Valid Server-Side Request Forgery High 2022-07-13 – 19 Any expired reset password link can still be used to reset the password #1615790 Valid Access Control Low 2022-09-01 $100 19 Cross-site Scripting (XSS) - Stored | forum.acronis.com #1161241 Valid Cross-site Scripting Medium 2022-02-08 – 20 Self XSS in attachments name #1536901 Valid No weakness recorded Low 2022-05-31 – 20 unauth mosquitto ( client emails, ips, license keys exposure ) #1578574 Valid Access Control Medium 2022-07-18 $150 20 Account Takeover on unverified emails in File Sync & Share #906790 Valid Misconfiguration and Insecure Design Medium 2021-06-16 – 21 Local File Disclosure /Delete On [us-az-vpn.acronis.com] #924407 Valid File and Path Handling Medium 2021-06-22 – 21 Local Privilege Escalation via Backup delete #1003007 Valid Access Control Medium 2024-08-27 $250 21 Cross Site Scripting (Reflected) on https://www.acronis.cz/dotaznik/roadshow-2020/ #1081747 Valid Cross-site Scripting Low 2024-08-26 $50 23 Reflected XSS on my.acronis.com #1168962 Valid Cross-site Scripting Low 2021-06-22 $50 24 CSRF and XSS on www.acronis.com #961787 Valid Cross-site Scripting Low 2024-08-26 – 25 XSS in https://promo.acronis.com/ #982442 Valid Cross-site Scripting Low 2024-08-26 – 25