CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-35145
https://notcve.org/view.php?id=CVE-2020-35145
Acronis True Image for Windows prior to 2021 Update 3 allowed local privilege escalation due to a DLL hijacking vulnerability in multiple components, aka an Untrusted Search Path issue. Acronis True Image para Windows versiones anteriores a 2021 Update 3, permitía una escalada de privilegios locales debido a una vulnerabilidad de secuestro DLL en múltiples componentes, también se conoce como un problema de Ruta de Búsqueda No Confiable • https://www.acronis.com/en-us/products/true-image https://www.acronis.com/en-us/support/updates/changes.html?p=42246 • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-10140
https://notcve.org/view.php?id=CVE-2020-10140
Acronis True Image 2021 fails to properly set ACLs of the C:\ProgramData\Acronis directory. Because some privileged processes are executed from the C:\ProgramData\Acronis, an unprivileged user can achieve arbitrary code execution with SYSTEM privileges by placing a DLL in one of several paths within C:\ProgramData\Acronis. Acronis True Image 2021 no configura correctamente las ACL del directorio C:\ProgramData\Acronis. Debido a que algunos procesos privilegiados se ejecutan desde C:\ProgramData\Acronis, un usuario sin privilegios puede lograr la ejecución de código arbitrario con privilegios SYSTEM colocando una DLL en una de varias rutas dentro de C:\ProgramData\Acronis • https://www.kb.cert.org/vuls/id/114757 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-10139
https://notcve.org/view.php?id=CVE-2020-10139
Acronis True Image 2021 includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. Acronis True Image contains a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectories off of the system root, a user can create the appropriate path to a specially-crafted openssl.cnf file to achieve arbitrary code execution with SYSTEM privileges. Acronis True Image 2021 incluye un componente OpenSSL que especifica una variable OPENSSLDIR como un subdirectorio dentro de C:\jenkins_agent\. Acronis True Image contiene un servicio privilegiado que usa este componente de OpenSSL. • https://www.kb.cert.org/vuls/id/114757 • CWE-284: Improper Access Control CWE-665: Improper Initialization •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-3219
https://notcve.org/view.php?id=CVE-2017-3219
Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash. Acronis True Image hasta e incluyendo la versión 2017 Build 8053 realiza actualizaciones de software mediante HTTP. Las actualizaciones descargadas solo se verifican por medio de un hash MD5 proporcionado por el servidor. • http://www.securityfocus.com/bid/99128 https://www.kb.cert.org/vuls/id/489392 • CWE-311: Missing Encryption of Sensitive Data CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2008-3671
https://notcve.org/view.php?id=CVE-2008-3671
Acronis True Image Echo Server 9.x build 8072 on Linux does not properly encrypt backups to an FTP server, which allows remote attackers to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Acronis True Image Echo Server 9.x build 8072 en Linux no encripta correctamente las copias de seguridad a un servidor FTP, lo que permite a atacantes remotos obtener información sensible. NOTA: el origen de esta información es desconocido; los detalles se han obtenido únicamente de información de terceros. The MyReview web application versions 1.9.9 and below and 2.0 Beta suffer from a mishandling of submissions allowing for unintended downloads of said data. • http://secunia.com/advisories/30856 http://www.securityfocus.com/bid/30456 • CWE-310: Cryptographic Issues •