Browse / Acronis

Acronis

See its reports on the map

What gets reported to Acronis

• Access Control39
• Cross-site Scripting35
• Authentication10
• Information Disclosure7
• Misconfiguration6
• SQL Injection5

Most upvoted reports

AllValidInformativeN/ADuplicate

1. SQL Injection in agent-managerSQL Injection · high
   237 votes
2. bypass sql injection #1109311SQL Injection · medium
   164 votes
3. IDOR vulnerability (Price manipulation)Insecure Direct Object Reference (IDOR) · medium
   146 votes
4. Ticket Trick at https://account.acronis.comImproper Access Control - Generic · high
   142 votes
5. [oem.acronis.com] Reflected Cross Site Scripting Cross-site Scripting (XSS) - Reflected · medium
   $100134 votes
6. IP restriction bypass via X-Forwarded-For headerForced Browsing · low
   $250126 votes
7. Stored XSS in backup scanning plan nameCross-site Scripting (XSS) - Stored · medium
   $500120 votes
8. SQL injection on admin.acronis.host development web serviceSQL Injection · high
   $250118 votes
9. Attacker Can Access to any Ticket Support on https://www.devicelock.com/support/Improper Access Control - Generic · medium
   109 votes
10. Rate limit bypass on passport.acronis.work using X-Forwarded-For request headerImproper Restriction of Authentication Attempts · medium
    106 votes
11. SQL injection in https://www.acronis.cz/ via the log parameterSQL Injection · medium
    103 votes
12. Flash Based Reflected XSS on www.grouplogic.com/jwplayer/player.swfCross-site Scripting (XSS) - Reflected · low
    89 votes
13. Reflected XSS on http://www.grouplogic.com/files/glidownload/verify.aspCross-site Scripting (XSS) - Reflected · low
    84 votes
14. Potential XSS Vulnerability in Acronis Login Callback URLCross-site Scripting (XSS) - Generic · high
    82 votes
15. Delete any user's added Email,Telephone,Fax,Address,Skype via csrf in (https://academy.acronis.com/)Cross-Site Request Forgery (CSRF) · low
    82 votes
16. PUT Based CSRF via Client Side Path Traversal + Cookie Bomb on Acronis CloudPath Traversal
    $60076 votes
17. [CVE-2021-44228] nps.acronis.com is vulnerable to the recent log4shell 0-dayDeserialization of Untrusted Data · critical
    $1,00076 votes
18. [forum.acronis.com] JNDI Code Injection due an outdated log4j componentOS Command Injection · critical
    74 votes
19. XSS on https://partners.acronis.com/Cross-site Scripting (XSS) - DOM · low
    73 votes
20. Reflected XSS in https://www.acronis.com/products/cyber-protect/trial/Cross-site Scripting (XSS) - Reflected · low
    $10072 votes
21. mail.acronis.com is vulnerable to zero day vulnerability CVE-2022-41040Server-Side Request Forgery (SSRF) · critical
    $1,00071 votes
22. Subdomain takeover of main domain of https://www.cyberlynx.lu/Privilege Escalation · medium
    $10070 votes
23. Reflected XSS on www.grouplogic.com/video.aspCross-site Scripting (XSS) - Reflected · low
    67 votes
24. Stored Cross-site Scripting on devicelock.com/forum/Cross-site Scripting (XSS) - Stored · medium
    65 votes
25. Blind XSS on admin.acronis.com via delete account form on account.acronis.comCross-site Scripting (XSS) - Stored · high
    65 votes
26. Potential XSS in redirect_url ParameterCross-site Scripting (XSS) - Reflected · medium
    64 votes
27. Stored XSS in Acronis Cyber Protect ConsoleCross-site Scripting (XSS) - Stored · medium
    $50063 votes
28. IDOR in backup recovery functionalityInsecure Direct Object Reference (IDOR) · high
    56 votes
29. Bypassing Recaptcha Protection in `https://connect.acronis.com`Violation of Secure Design Principles · low
    54 votes
30. Blind SSRF vulnerability on cz.acronis.comServer-Side Request Forgery (SSRF) · medium
    53 votes
31. DOM Based Cookie Bomb in *.acronis.com via x-clickref GET ParameterUncontrolled Resource Consumption
    $20052 votes
32. HTML Injection in E-mailCross-site Scripting (XSS) - Generic · low
    52 votes
33. SQL injection in https://demor.adr.acronis.com/ via the username parameterSQL Injection · high
    49 votes
34. IDOR on www.acronis.com API lead to steal private business user informationInsecure Direct Object Reference (IDOR) · medium
    $10048 votes
35. Render content from untrusted sources via web_preview endpoint on Acronis CloudResource Injection
    $20046 votes
36. admin password disclosure via log file Information Disclosure · medium
    $10045 votes
37. Stored XSS in profile pageCross-site Scripting (XSS) - Stored · medium
    $5045 votes
38. Missing rate limit for current password field (Password Change) Account TakeoverImproper Restriction of Authentication Attempts · medium
    44 votes
39. Reflected XSS via "Error" parameter on https://admin.acronis.com/admin/su/Cross-site Scripting (XSS) - Reflected · medium
    $5039 votes
40. Arbitrary file creation via symlink attack on syncagentsrv (Acronis Sync Agent Service)Privilege Escalation · high
    38 votes
41. CSS Injection via Client Side Path Traversal + Open Redirect leads to personal data exfiltration on Acronis CloudCross-site Scripting (XSS) - DOM · medium
    37 votes
42. FULL SSRF Server-Side Request Forgery (SSRF) · low
    37 votes
43. Self XSS on Acronis Cyber CloudCross-site Scripting (XSS) - Generic · low
    $10037 votes
44. %0A (New line) and limitness URL leads to DoS at all system [Main adress (https://www.acronis.com/)]Uncontrolled Resource Consumption · low
    36 votes
45. licenses key disclosureCleartext Storage of Sensitive Information · low
    $5036 votes
46. Possible LDAP username and password disclosed on GithubInformation Disclosure · medium
    36 votes
47. Reflected XSS on www.acronis.com/de-de/my/subscriptions/index.htmlCross-site Scripting (XSS) - Reflected · low
    34 votes
48. Acronis True Image (Windows) does not validate server certificate on a TLS connectionImproper Certificate Validation · high
    $50034 votes
49. [CVE-2021-44228] Arbitrary Code Execution on ng01-cloud.acronis.comCode Injection · critical
    33 votes
50. Blind Stored XSS in https://partners.acronis.com/admin which lead to sensitive information/PII leakageCross-site Scripting (XSS) - Stored · high
    $15033 votes
51. [acronis.secure.force.com] - Insecure Salesforce default/custom object permissions leads to information disclosureInformation Disclosure · low
    31 votes
52. SSRF when configuring Website Backup on Acronis CloudServer-Side Request Forgery (SSRF)
    $50030 votes
53. Local Privilege Escalation and Code Execution when restoring files from QuarantinePrivilege Escalation · medium
    $25030 votes
54. XSS in (Support Requests) : User CasesCross-site Scripting (XSS) - Stored · medium
    $5030 votes
55. Read-only administrator can change agent update settingsImproper Access Control - Generic · medium
    $20029 votes
56. Web cache poisoning at www.acronis.comViolation of Secure Design Principles · medium
    29 votes
57. XSS Stored in Cacheable responseCross-site Scripting (XSS) - Stored · medium
    28 votes
58. mysql credentials exposed on - https://cz.acronis.com/docker-compose.ymlInsufficiently Protected Credentials · low
    28 votes
59. Cross Site Scripting (Reflected) on https://www.acronis.cz/Cross-site Scripting (XSS) - Reflected · low
    $5027 votes
60. Credentials leaked via GithubUse of Hard-coded Credentials · medium
    $5026 votes
61. Local Privilege Escalation via DLL Search-Order Hijacking with Cyber Protection Agent - systeminfo.exe utilityPrivilege Escalation · medium
    26 votes
62. Cross Origin Resource Sharing MisconfigurationImproper Access Control - Generic · medium
    26 votes
63. Administrative access to development deployment of web service due to auto-filled credentialsImproper Authentication - Generic · high
    $25026 votes
64. HTML Injection in E-mail Not Resolved ()Cross-site Scripting (XSS) - Generic · medium
    25 votes
65. Local Privilege Escalation when updating Acronis True ImagePrivilege Escalation · medium
    $25025 votes
66. Local privilege escalation via insecure MSI filePrivilege Escalation · high
    $25025 votes
67. XSS in https://promo.acronis.com/Cross-site Scripting (XSS) - DOM · low
    25 votes
68. CSRF and XSS on www.acronis.comCross-site Scripting (XSS) - Reflected · low
    25 votes
69. Reflected XSS on my.acronis.comCross-site Scripting (XSS) - Generic · low
    $5024 votes
70. Cross Site Scripting (Reflected) on https://www.acronis.cz/dotaznik/roadshow-2020/Cross-site Scripting (XSS) - Reflected · low
    $5023 votes
71. Local Privilege Escalation via Backup deletePrivilege Escalation · medium
    $25021 votes
72. Local File Disclosure /Delete On [us-az-vpn.acronis.com]Path Traversal · medium
    21 votes
73. Account Takeover on unverified emails in File Sync & Share Violation of Secure Design Principles · medium
    21 votes
74. unauth mosquitto ( client emails, ips, license keys exposure )Improper Access Control - Generic · medium
    $15020 votes
75. Self XSS in attachments nameCross-site Scripting (XSS) - Generic · low
    20 votes
76. Cross-site Scripting (XSS) - Stored | forum.acronis.comCross-site Scripting (XSS) - Stored · medium
    20 votes
77. Any expired reset password link can still be used to reset the passwordImproper Access Control - Generic · low
    $10019 votes
78. CVE-2021-40438 on cp-eu2.acronis.comServer-Side Request Forgery (SSRF) · high
    19 votes
79. Clickjacking on cas.acronis.com login pageUI Redressing (Clickjacking) · low
    19 votes
80. DOM based XSS in store.acronis.com/<id>/purl-corporate-standard-IT [cfg parameter]Cross-site Scripting (XSS) - DOM · low
    $5019 votes
81. Subdomain Takeover – www.jet.acronis.com pointing to unclaimed Webflow servicesPrivilege Escalation · low
    19 votes
82. Broken Access ControlsImproper Access Control - Generic
    19 votes
83. Acronis True Image 2021 (windows) does not validate server hostname on a login TLS connectionImproper Certificate Validation · high
    $25018 votes
84. Acronis True Image 2020 Build 22510 Nonstop Backup Service Unquoted service path (privilege escalation)Privilege Escalation · low
    17 votes
85. anti_ransomware_service.exe REST API does not require authenticationMissing Authentication for Critical Function · medium
    17 votes
86. Missing brute force protection on login page on www.acronis.comImproper Restriction of Authentication Attempts
    $25016 votes
87. HTTP Request Smuggling on https://consumer.acronis.comHTTP Request Smuggling · low
    16 votes
88. Store Admin Page Accessible Without Authentication at http://www.grouplogic.com/ADMIN/store/index.cfmImproper Access Control - Generic · medium
    $25015 votes
89. Stored Cross Site Scripting at http://www.grouplogic.com/ADMIN/store/index.cfm?fa=disprocodeCross-site Scripting (XSS) - Stored · medium
    15 votes
90. DLL Hijacking when sending feedback and crash report leading to Privilege EscalationPrivilege Escalation · medium
    $25015 votes
91. Large Amounts of Back-End Acronis Source Code is Publicly AccessibleInformation Exposure Through Directory Listing · medium
    $25015 votes
92. Arbitrary Files and Folders Deletion vulnerability with Acronis Managed Machine ServicePrivilege Escalation · medium
    15 votes
93. Subdomain Takeover – jet.acronis.com pointing to unclaimed Webflow servicesPrivilege Escalation · low
    15 votes
94. Acronis True Image Local Privilege Escalation via insecure folder permissionsPrivilege Escalation · medium
    $30015 votes
95. TrueImage for Acronis True Image 2020 - Untrusted DLL Search-Ordering lead to Privilege Escalation as Administrative accountPrivilege Escalation · medium
    $25014 votes
96. No Rate Limit On Forgot Password PageN/AImproper Access Control - Generic · medium
    13 votes
97. DLL Hijacking when creating Rescue Media Builder leading to Privilege EscalationPrivilege Escalation · medium
    $25013 votes
98. HTTP Request Smuggling on https://promosandbox.acronis.comHTTP Request Smuggling · low
    12 votes
99. Open redirect at mc-beta-cloud-acronis.comOpen Redirect
    12 votes
100. Local Privilege Escalation when deleting a file from QuarantinePrivilege Escalation · medium
     $25011 votes