SQL Injection in agent-manager Analysed #962889 Valid SQL Injection – 2021-08-16 – 237 bypass sql injection #1109311 #1224660 Valid SQL Injection – 2021-10-05 – 164 IDOR vulnerability (Price manipulation) #1403176 Valid Insecure Direct Object Reference – 2021-11-30 – 146 Ticket Trick at https://account.acronis.com #999765 Valid Access Control – 2020-11-10 – 142 [oem.acronis.com] Reflected Cross Site Scripting #2038943 Valid Cross-site Scripting Medium 2024-12-28 $100 134 IP restriction bypass via X-Forwarded-For header #1224089 Valid Access Control Low 2024-12-05 $250 126 Stored XSS in backup scanning plan name #961046 Valid Cross-site Scripting – 2021-06-28 $500 120 SQL injection on admin.acronis.host development web service #923020 Valid SQL Injection – 2021-06-22 $250 118 Attacker Can Access to any Ticket Support on https://www.devicelock.com/support/ #1124974 Valid Access Control – 2022-02-08 – 109 Rate limit bypass on passport.acronis.work using X-Forwarded-For request header #2627062 Valid No weakness recorded Medium 2024-11-28 – 106 SQL injection in https://www.acronis.cz/ via the log parameter #1109311 Valid SQL Injection – 2021-06-11 – 103 Flash Based Reflected XSS on www.grouplogic.com/jwplayer/player.swf #859806 Valid Cross-site Scripting – 2021-04-13 – 89 Reflected XSS on http://www.grouplogic.com/files/glidownload/verify.asp #859395 Valid Cross-site Scripting – 2021-04-13 – 84 Potential XSS Vulnerability in Acronis Login Callback URL #2611305 Valid Cross-site Scripting High 2024-11-06 – 82 Delete any user's added Email,Telephone,Fax,Address,Skype via csrf in (https://academy.acronis.com/) #709537 Valid No weakness recorded – 2023-04-25 – 82 PUT Based CSRF via Client Side Path Traversal + Cookie Bomb on Acronis Cloud #1860380 No longer public File and Path Handling – – $600 76 [CVE-2021-44228] nps.acronis.com is vulnerable to the recent log4shell 0-day #1425474 Valid Deserialization and Object Injection – 2022-07-13 $1,000 76 [forum.acronis.com] JNDI Code Injection due an outdated log4j component #1430622 Valid Command and Code Injection Critical 2024-08-28 – 74 XSS on https://partners.acronis.com/ #979204 Valid Cross-site Scripting – 2021-06-17 – 73 Reflected XSS in https://www.acronis.com/products/cyber-protect/trial/ #1891926 Valid Cross-site Scripting Low 2024-11-20 $100 72 mail.acronis.com is vulnerable to zero day vulnerability CVE-2022-41040 #1719719 Valid Server-Side Request Forgery – 2022-10-13 $1,000 71 Subdomain takeover of main domain of https://www.cyberlynx.lu/ #1256389 Valid Access Control – 2021-10-12 $100 70 Reflected XSS on www.grouplogic.com/video.asp #859802 Valid Cross-site Scripting – 2021-04-13 – 67 Stored Cross-site Scripting on devicelock.com/forum/ #1122513 Valid Cross-site Scripting – 2022-02-08 – 65 Blind XSS on admin.acronis.com via delete account form on account.acronis.com #666040 Not checked yet Cross-site Scripting – – – 65 Potential XSS in redirect_url Parameter #2653342 Valid Cross-site Scripting Medium 2024-11-06 – 64 Stored XSS in Acronis Cyber Protect Console #1064095 Valid Cross-site Scripting – 2021-06-10 $500 63 IDOR in backup recovery functionality #1901713 Valid No weakness recorded High 2024-11-13 – 56 Bypassing Recaptcha Protection in `https://connect.acronis.com` #1655629 Valid Misconfiguration and Insecure Design Low 2024-10-30 – 54 Blind SSRF vulnerability on cz.acronis.com #1086206 Valid Server-Side Request Forgery Medium 2024-08-27 – 53 DOM Based Cookie Bomb in *.acronis.com via x-clickref GET Parameter #1898305 No longer public Denial of Service – – $200 52 HTML Injection in E-mail #1536899 Valid No weakness recorded – 2022-06-14 – 52 SQL injection in https://demor.adr.acronis.com/ via the username parameter #1436751 Valid SQL Injection High 2024-08-28 – 49 IDOR on www.acronis.com API lead to steal private business user information #1182465 Valid Insecure Direct Object Reference – 2021-08-31 $100 48 Render content from untrusted sources via web_preview endpoint on Acronis Cloud #1848118 No longer public Injection and Smuggling – – $200 46 admin password disclosure via log file #1121972 Valid Information Disclosure – 2021-12-21 $100 45 Stored XSS in profile page #1084183 Valid Cross-site Scripting – 2021-11-14 $50 45 Missing rate limit for current password field (Password Change) Account Takeover #827484 Valid Authentication – 2020-10-06 – 44 Reflected XSS via "Error" parameter on https://admin.acronis.com/admin/su/ #970878 Valid Cross-site Scripting – 2021-07-19 $50 39 Arbitrary file creation via symlink attack on syncagentsrv (Acronis Sync Agent Service) #945122 Valid Access Control – 2021-03-16 – 38 CSS Injection via Client Side Path Traversal + Open Redirect leads to personal data exfiltration on Acronis Cloud #1245165 Valid Cross-site Scripting – 2022-11-04 – 37 FULL SSRF #1241149 Valid Server-Side Request Forgery – 2022-02-22 – 37 Self XSS on Acronis Cyber Cloud #957229 Valid Cross-site Scripting – 2021-06-28 $100 37 %0A (New line) and limitness URL leads to DoS at all system [Main adress (https://www.acronis.com/)] #1382448 Valid Denial of Service – 2022-01-04 – 36 licenses key disclosure #1079630 Valid Cryptography – 2021-02-09 $50 36 Possible LDAP username and password disclosed on Github #1004412 Valid Information Disclosure – 2021-08-17 – 36 Reflected XSS on www.acronis.com/de-de/my/subscriptions/index.html #1145712 Valid Cross-site Scripting Low 2024-08-27 – 34 Acronis True Image (Windows) does not validate server certificate on a TLS connection #1056144 Valid Cryptography – 2021-08-05 $500 34 [CVE-2021-44228] Arbitrary Code Execution on ng01-cloud.acronis.com #1459714 Valid No weakness recorded Critical 2024-08-28 – 33 Blind Stored XSS in https://partners.acronis.com/admin which lead to sensitive information/PII leakage #1028820 Valid Cross-site Scripting – 2021-07-29 $150 33