Ticket Trick at https://account.acronis.com Analysed #999765 Valid Access Control High 2020-11-10 – 142 Stored XSS in backup scanning plan name Analysed #961046 Valid Cross-site Scripting Medium 2021-06-28 $500 120 Attacker Can Access to any Ticket Support on https://www.devicelock.com/support/ Analysed #1124974 Valid Access Control Medium 2022-02-08 – 109 Delete any user's added Email,Telephone,Fax,Address,Skype via csrf in (https://academy.acronis.com/) Analysed #709537 Valid No weakness recorded Low 2023-04-25 – 82 Stored Cross-site Scripting on devicelock.com/forum/ Analysed #1122513 Valid Cross-site Scripting Medium 2022-02-08 – 65 Blind XSS on admin.acronis.com via delete account form on account.acronis.com Analysed #666040 Valid Cross-site Scripting High 2024-10-30 – 65 Potential XSS in redirect_url Parameter Analysed #2653342 Valid Cross-site Scripting Medium 2024-11-06 – 64 Stored XSS in Acronis Cyber Protect Console Analysed #1064095 Valid Cross-site Scripting Medium 2021-06-10 $500 63 IDOR in backup recovery functionality Analysed #1901713 Valid No weakness recorded High 2024-11-13 – 56 IDOR on www.acronis.com API lead to steal private business user information Analysed #1182465 Valid Insecure Direct Object Reference Medium 2021-08-31 $100 48 Stored XSS in profile page Analysed #1084183 Valid Cross-site Scripting Medium 2021-11-14 $50 45 Missing rate limit for current password field (Password Change) Account Takeover Analysed #827484 Valid Authentication Medium 2020-10-06 – 44 Arbitrary file creation via symlink attack on syncagentsrv (Acronis Sync Agent Service) Analysed #945122 Valid Access Control High 2021-03-16 – 38 CSS Injection via Client Side Path Traversal + Open Redirect leads to personal data exfiltration on Acronis Cloud Analysed #1245165 Valid Cross-site Scripting Medium 2022-11-04 – 37 FULL SSRF Analysed #1241149 Valid Server-Side Request Forgery Low 2022-02-22 – 37 Self XSS on Acronis Cyber Cloud Analysed #957229 Valid Cross-site Scripting Low 2021-06-28 $100 37 Local Privilege Escalation and Code Execution when restoring files from Quarantine Analysed #980500 Valid Access Control Medium 2024-08-27 $250 30 XSS in (Support Requests) : User Cases Analysed #961226 Valid Cross-site Scripting Medium 2021-06-24 $50 30 Read-only administrator can change agent update settings Analysed #1538004 Valid Access Control Medium 2022-08-10 $200 29 Local Privilege Escalation via DLL Search-Order Hijacking with Cyber Protection Agent - systeminfo.exe utility Analysed #959608 Valid Access Control Medium 2024-08-27 – 26 Local Privilege Escalation when updating Acronis True Image Analysed #1075449 Valid Access Control Medium 2024-08-27 $250 25 Local privilege escalation via insecure MSI file Analysed #1071832 Valid Access Control High 2021-08-07 $250 25 Local Privilege Escalation via Backup delete Analysed #1003007 Valid Access Control Medium 2024-08-27 $250 21 Account Takeover on unverified emails in File Sync & Share Analysed #906790 Valid Misconfiguration and Insecure Design Medium 2021-06-16 – 21 Self XSS in attachments name Analysed #1536901 Valid No weakness recorded Low 2022-05-31 – 20 Cross-site Scripting (XSS) - Stored | forum.acronis.com Analysed #1161241 Valid Cross-site Scripting Medium 2022-02-08 – 20 Any expired reset password link can still be used to reset the password Analysed #1615790 Valid Access Control Low 2022-09-01 $100 19 Acronis True Image 2020 Build 22510 Nonstop Backup Service Unquoted service path (privilege escalation) Analysed #1083532 Valid Access Control Low 2024-08-27 – 17 anti_ransomware_service.exe REST API does not require authentication Analysed #858608 Valid Authentication Medium 2021-06-24 – 17 Missing brute force protection on login page on www.acronis.com Analysed #1435392 Valid Authentication – 2023-08-30 $250 16 DLL Hijacking when sending feedback and crash report leading to Privilege Escalation Analysed #1008427 Valid Access Control Medium 2024-08-27 $250 15 Arbitrary Files and Folders Deletion vulnerability with Acronis Managed Machine Service Analysed #959815 Valid Access Control Medium 2024-08-27 – 15 TrueImage for Acronis True Image 2020 - Untrusted DLL Search-Ordering lead to Privilege Escalation as Administrative account Analysed #959017 Valid Access Control Medium 2024-08-27 $250 14 DLL Hijacking when creating Rescue Media Builder leading to Privilege Escalation Analysed #1010552 Valid Access Control Medium 2024-08-27 $250 13