Skip to content

Latest commit

 

History

History
130 lines (129 loc) · 17.3 KB

TOPACRONIS.md

File metadata and controls

130 lines (129 loc) · 17.3 KB

Top reports from Acronis program at HackerOne:

  1. SQL Injection in agent-manager to Acronis - 228 upvotes, $0
  2. bypass sql injection #1109311 to Acronis - 159 upvotes, $0
  3. Ticket Trick at https://account.acronis.com to Acronis - 137 upvotes, $750
  4. IDOR vulnerability (Price manipulation) to Acronis - 134 upvotes, $0
  5. Stored XSS in backup scanning plan name to Acronis - 117 upvotes, $500
  6. [oem.acronis.com] Reflected Cross Site Scripting to Acronis - 117 upvotes, $100
  7. SQL injection on admin.acronis.host development web service to Acronis - 111 upvotes, $250
  8. Attacker Can Access to any Ticket Support on https://www.devicelock.com/support/ to Acronis - 103 upvotes, $0
  9. IP restriction bypass via X-Forwarded-For header to Acronis - 101 upvotes, $250
  10. SQL injection in https://www.acronis.cz/ via the log parameter to Acronis - 97 upvotes, $0
  11. Rate limit bypass on passport.acronis.work using X-Forwarded-For request header to Acronis - 88 upvotes, $250
  12. Flash Based Reflected XSS on www.grouplogic.com/jwplayer/player.swf to Acronis - 84 upvotes, $0
  13. Reflected XSS on http://www.grouplogic.com/files/glidownload/verify.asp to Acronis - 81 upvotes, $0
  14. PUT Based CSRF via Client Side Path Traversal + Cookie Bomb on Acronis Cloud to Acronis - 76 upvotes, $600
  15. Delete any user's added Email,Telephone,Fax,Address,Skype via csrf in (https://academy.acronis.com/) to Acronis - 75 upvotes, $0
  16. [CVE-2021-44228] nps.acronis.com is vulnerable to the recent log4shell 0-day to Acronis - 73 upvotes, $1000
  17. XSS on https://partners.acronis.com/ to Acronis - 72 upvotes, $0
  18. mail.acronis.com is vulnerable to zero day vulnerability CVE-2022-41040 to Acronis - 70 upvotes, $1000
  19. Subdomain takeover of main domain of https://www.cyberlynx.lu/ to Acronis - 69 upvotes, $100
  20. Potential XSS Vulnerability in Acronis Login Callback URL to Acronis - 69 upvotes, $100
  21. Reflected XSS on www.grouplogic.com/video.asp to Acronis - 64 upvotes, $0
  22. Stored Cross-site Scripting on devicelock.com/forum/ to Acronis - 64 upvotes, $0
  23. Stored XSS in Acronis Cyber Protect Console to Acronis - 63 upvotes, $500
  24. Reflected XSS in https://www.acronis.com/products/cyber-protect/trial/ to Acronis - 63 upvotes, $100
  25. [forum.acronis.com] JNDI Code Injection due an outdated log4j component to Acronis - 63 upvotes, $0
  26. Blind XSS on admin.acronis.com via delete account form on account.acronis.com to Acronis - 60 upvotes, $0
  27. Potential XSS in redirect_url Parameter to Acronis - 55 upvotes, $100
  28. DOM Based Cookie Bomb in *.acronis.com via x-clickref GET Parameter to Acronis - 52 upvotes, $200
  29. HTML Injection in E-mail to Acronis - 51 upvotes, $0
  30. Bypassing Recaptcha Protection in https://connect.acronis.com to Acronis - 47 upvotes, $0
  31. Render content from untrusted sources via web_preview endpoint on Acronis Cloud to Acronis - 46 upvotes, $200
  32. Stored XSS in profile page to Acronis - 45 upvotes, $50
  33. IDOR in backup recovery functionality to Acronis - 45 upvotes, $0
  34. admin password disclosure via log file to Acronis - 43 upvotes, $100
  35. Missing rate limit for current password field (Password Change) Account Takeover to Acronis - 39 upvotes, $0
  36. SQL injection in https://demor.adr.acronis.com/ via the username parameter to Acronis - 39 upvotes, $0
  37. Reflected XSS via "Error" parameter on https://admin.acronis.com/admin/su/ to Acronis - 38 upvotes, $50
  38. Self XSS on Acronis Cyber Cloud to Acronis - 37 upvotes, $100
  39. Arbitrary file creation via symlink attack on syncagentsrv (Acronis Sync Agent Service) to Acronis - 37 upvotes, $0
  40. IDOR on www.acronis.com API lead to steal private business user information to Acronis - 36 upvotes, $100
  41. licenses key disclosure to Acronis - 35 upvotes, $50
  42. Possible LDAP username and password disclosed on Github to Acronis - 35 upvotes, $0
  43. %0A (New line) and limitness URL leads to DoS at all system [Main adress (https://www.acronis.com/)] to Acronis - 35 upvotes, $0
  44. FULL SSRF to Acronis - 35 upvotes, $0
  45. Acronis True Image (Windows) does not validate server certificate on a TLS connection to Acronis - 34 upvotes, $500
  46. Blind SSRF vulnerability on cz.acronis.com to Acronis - 34 upvotes, $0
  47. Blind Stored XSS in https://partners.acronis.com/admin which lead to sensitive information/PII leakage to Acronis - 32 upvotes, $150
  48. SSRF when configuring Website Backup on Acronis Cloud to Acronis - 30 upvotes, $500
  49. [CVE-2021-44228] Arbitrary Code Execution on ng01-cloud.acronis.com to Acronis - 30 upvotes, $0
  50. XSS in (Support Requests) : User Cases to Acronis - 29 upvotes, $50
  51. CSS Injection via Client Side Path Traversal + Open Redirect leads to personal data exfiltration on Acronis Cloud to Acronis - 29 upvotes, $0
  52. [acronis.secure.force.com] - Insecure Salesforce default/custom object permissions leads to information disclosure to Acronis - 28 upvotes, $0
  53. mysql credentials exposed on - https://cz.acronis.com/docker-compose.yml to Acronis - 28 upvotes, $0
  54. Read-only administrator can change agent update settings to Acronis - 27 upvotes, $200
  55. XSS Stored in Cacheable response to Acronis - 27 upvotes, $0
  56. Cross Site Scripting (Reflected) on https://www.acronis.cz/ to Acronis - 26 upvotes, $50
  57. Credentials leaked via Github to Acronis - 24 upvotes, $0
  58. Administrative access to development deployment of web service due to auto-filled credentials to Acronis - 23 upvotes, $250
  59. Local privilege escalation via insecure MSI file to Acronis - 23 upvotes, $250
  60. Local Privilege Escalation and Code Execution when restoring files from Quarantine to Acronis - 23 upvotes, $250
  61. Reflected XSS on my.acronis.com to Acronis - 23 upvotes, $50
  62. HTML Injection in E-mail Not Resolved () to Acronis - 23 upvotes, $0
  63. Reflected XSS on www.acronis.com/de-de/my/subscriptions/index.html to Acronis - 23 upvotes, $0
  64. Local Privilege Escalation via DLL Search-Order Hijacking with Cyber Protection Agent - systeminfo.exe utility to Acronis - 23 upvotes, $0
  65. Web cache poisoning at www.acronis.com to Acronis - 21 upvotes, $0
  66. Local File Disclosure /Delete On [us-az-vpn.acronis.com] to Acronis - 21 upvotes, $0
  67. Local Privilege Escalation when updating Acronis True Image to Acronis - 20 upvotes, $250
  68. Cross-site Scripting (XSS) - Stored | forum.acronis.com to Acronis - 20 upvotes, $0
  69. CSRF and XSS on www.acronis.com to Acronis - 20 upvotes, $0
  70. XSS in https://promo.acronis.com/ to Acronis - 20 upvotes, $0
  71. Cross Origin Resource Sharing Misconfiguration to Acronis - 19 upvotes, $0
  72. unauth mosquitto ( client emails, ips, license keys exposure ) to Acronis - 18 upvotes, $150
  73. DOM based XSS in store.acronis.com/<id>/purl-corporate-standard-IT [cfg parameter] to Acronis - 18 upvotes, $50
  74. Cross Site Scripting (Reflected) on https://www.acronis.cz/dotaznik/roadshow-2020/ to Acronis - 18 upvotes, $50
  75. Account Takeover on unverified emails in File Sync & Share to Acronis - 18 upvotes, $0
  76. Self XSS in attachments name to Acronis - 18 upvotes, $0
  77. Acronis True Image 2021 (windows) does not validate server hostname on a login TLS connection to Acronis - 17 upvotes, $250
  78. Any expired reset password link can still be used to reset the password to Acronis - 17 upvotes, $100
  79. Clickjacking on cas.acronis.com login page to Acronis - 17 upvotes, $0
  80. Subdomain Takeover – www.jet.acronis.com pointing to unclaimed Webflow services to Acronis - 17 upvotes, $0
  81. CVE-2021-40438 on cp-eu2.acronis.com to Acronis - 17 upvotes, $0
  82. Missing brute force protection on login page on www.acronis.com to Acronis - 16 upvotes, $250
  83. Local Privilege Escalation via Backup delete to Acronis - 16 upvotes, $250
  84. Broken Access Controls to Acronis - 16 upvotes, $0
  85. anti_ransomware_service.exe REST API does not require authentication to Acronis - 16 upvotes, $0
  86. Stored Cross Site Scripting at http://www.grouplogic.com/ADMIN/store/index.cfm?fa=disprocode to Acronis - 15 upvotes, $0
  87. Acronis True Image Local Privilege Escalation via insecure folder permissions to Acronis - 13 upvotes, $300
  88. Store Admin Page Accessible Without Authentication at http://www.grouplogic.com/ADMIN/store/index.cfm to Acronis - 13 upvotes, $250
  89. Large Amounts of Back-End Acronis Source Code is Publicly Accessible to Acronis - 13 upvotes, $250
  90. Subdomain Takeover – jet.acronis.com pointing to unclaimed Webflow services to Acronis - 13 upvotes, $0
  91. No Rate Limit On Forgot Password Page to Acronis - 12 upvotes, $0
  92. HTTP Request Smuggling on https://promosandbox.acronis.com to Acronis - 12 upvotes, $0
  93. HTTP Request Smuggling on https://consumer.acronis.com to Acronis - 12 upvotes, $0
  94. Acronis True Image 2020 Build 22510 Nonstop Backup Service Unquoted service path (privilege escalation) to Acronis - 12 upvotes, $0
  95. DLL Hijacking when sending feedback and crash report leading to Privilege Escalation to Acronis - 11 upvotes, $250
  96. Open redirect at mc-beta-cloud-acronis.com to Acronis - 11 upvotes, $0
  97. No brute force protection on web-api-cloud.acronis.com to Acronis - 10 upvotes, $100
  98. Arbitrary DLL injection in mmsminisrv (Acronis Managed Machine Service Mini) to Acronis - 10 upvotes, $0
  99. Arbitrary Files and Folders Deletion vulnerability with Acronis Managed Machine Service to Acronis - 10 upvotes, $0
  100. DLL Hijacking when creating Rescue Media Builder leading to Privilege Escalation to Acronis - 9 upvotes, $250
  101. TrueImage for Acronis True Image 2020 - Untrusted DLL Search-Ordering lead to Privilege Escalation as Administrative account to Acronis - 9 upvotes, $250
  102. Get ip and Geo location any user via Clickjacking with inspectlet technology to Acronis - 9 upvotes, $0
  103. Reflected XSS on cz.acronis.com/dekujeme-za-odber-novinek-produktu-disk-director with ability to creating an admin user in WordPress to Acronis - 9 upvotes, $0
  104. Local Privilege Escalation when deleting a file from Quarantine to Acronis - 8 upvotes, $250
  105. Domain does not Match SSL Certificate to Acronis - 8 upvotes, $0
  106. Acronis Sync Agent Service - Untrusted DLL Search-Ordering lead to Privilege Escalation to Acronis - 7 upvotes, $250
  107. XSS in Acronis Cloud Manager Admin Portal to Acronis - 7 upvotes, $100
  108. Content Spoofing to Acronis - 7 upvotes, $0
  109. Denial of Service in anti_ransomware_service.exe via logs files to Acronis - 7 upvotes, $0
  110. No server side check on terms of service page which leads to bypass to Acronis - 7 upvotes, $0
  111. Acronis True Image Local Privilege Escalation Due To Race Condition In Application Verification to Acronis - 7 upvotes, $0
  112. True Image 2021 - LPE via XPC service communication to Acronis - 5 upvotes, $250
  113. Unrestricted file upload vulnerability in IMCE to Acronis - 5 upvotes, $0
  114. Local Privilege Escalation in anti_ransomware_service.exe via quarantine to Acronis - 5 upvotes, $0
  115. Session Fixation on Acronis to Acronis - 5 upvotes, $0
  116. Reflected Cross Site Scripting at http://www.grouplogic.com/files/glidownload/verify3.asp [Uppercase Filter Bypass] to Acronis - 5 upvotes, $0
  117. DLL Hijacking when performing operations in Acronis Secure Zone partition leading to Privilege Escalation to Acronis - 4 upvotes, $250
  118. Account Confirmation bypass leads to acess some fucntionality to Acronis - 4 upvotes, $0
  119. Information Disclosure via ZIP file on AWS Bucket [http://acronis.1.s3.amazonaws.com] to Acronis - 4 upvotes, $0
  120. Self-DoS due to template injection via email field in password reset form on access.acronis.com to Acronis - 4 upvotes, $0
  121. Reflected Cross Site Scripting at ColdFusion Debugging Panel http://www.grouplogic.com/CFIDE/debug/cf_debugFr.cfm to Acronis - 4 upvotes, $0
  122. Local Privilege Escalation via DLL Search-Order Hijacking with Cyber Protection Agent - tibxread.exe utility to Acronis - 4 upvotes, $0
  123. Local Privilege Escalation via EXE hijacking with Acronis True Image 2021 - Acronis Scheduler2 Service to Acronis - 4 upvotes, $0
  124. CVE-2020-6287 https://redapi2.acronis.com to Acronis - 3 upvotes, $0
  125. Local Privilege Escalation via EXE hijacking with Acronis True Image 2021 installer to Acronis - 3 upvotes, $0
  126. ClickJacking to Acronis - 2 upvotes, $0
  127. Found multiple SAP NetWeaver vulnerable services to Acronis - 1 upvotes, $0
  128. Subdomains takeover of register.acronis.com, promo.acronis.com, info.acronis.com and promosandbox.acronis.com to Acronis - 1 upvotes, $0