Accela Civic Platform Citizen Access portal Arbitrary File Upload Vulnerability

The Accela Civic Platform Citizen Access portal is a web portal from Accela, Inc. that connects citizens to government. An arbitrary file upload vulnerability exists in the Accela Civic Platform Citizen Access portal, which can be exploited by an attacker to upload arbitrary files to a web server...

Accela Civic Platform Citizen Access portal cross-site scripting vulnerability

Accela Civic Platform Citizen Access portal is a web portal for citizens and government to connect and interact. Cross-site scripting vulnerabilities exist in the Accela Civic Platform Citizen Access portal. These vulnerabilities can be exploited by an attacker to steal cookie-based authenticatio...

CVE-2016-5661

Accela Civic Platform Citizen Access portal relies on the client to restrict file types for uploads, which allows remote authenticated users to execute arbitrary code via modified EventArgument and filename parameters...

CVE-2016-5660

Cross-site scripting XSS vulnerability in AttachmentsList.aspx in Accela Civic Platform Citizen Access portal allows remote attackers to inject arbitrary web script or HTML via the iframeid parameter...

Code injection

Accela Civic Platform Citizen Access portal relies on the client to restrict file types for uploads, which allows remote authenticated users to execute arbitrary code via modified EventArgument and filename parameters...

Cross site scripting

Cross-site scripting XSS vulnerability in AttachmentsList.aspx in Accela Civic Platform Citizen Access portal allows remote attackers to inject arbitrary web script or HTML via the iframeid parameter...

CVE-2016-5661

Accela Civic Platform Citizen Access portal is affected by CVE-2016-5661: Arbitrary file upload vulnerability where the portal relies on client-side file-type checks and an attacker can bypass these restrictions by manipulating the _EventArgument and filename parameters to upload arbitrary files....

CVE-2016-5660

CVE-2016-5660 is an XSS vulnerability in the Accela Civic Platform Citizen Access portal, specifically in AttachmentsList.aspx via the iframeid parameter. The issue allows remote attackers to inject arbitrary web script or HTML. Documents indicate vulnerability details but do not specify affected...

CVE-2016-5660

Cross-site scripting XSS vulnerability in AttachmentsList.aspx in Accela Civic Platform Citizen Access portal allows remote attackers to inject arbitrary web script or HTML via the iframeid parameter...

PT-2016-6618

Name of the Vulnerable Software and Affected Versions Accela Civic Platform Citizen Access portal affected versions not specified Description A cross-site scripting XSS issue exists in the AttachmentsList.aspx page of the Accela Civic Platform Citizen Access portal. This allows remote attackers t...

CVE-2016-5660: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in AttachmentsList.aspx in Accela Civic Platform Citizen Access portal allows remote attackers to inject arbitrary web script or HTML via the iframeid parameter...

CVE-2016-5661: Improper Access Control

Accela Civic Platform Citizen Access portal relies on the client to restrict file types for uploads, which allows remote authenticated users to execute arbitrary code via modified EventArgument and filename parameters...

PT-2016-6619

Name of the Vulnerable Software and Affected Versions Accela Civic Platform Citizen Access portal affected versions not specified Description The issue allows remote authenticated users to execute arbitrary code by modifying the EventArgument and filename parameters. This is possible because the...

Accela Civic Platform Citizen Access portal contains multiple vulnerabilities

Overview Accela Civic Platform Citizen Access portal contains cross-site scripting and arbitrary file upload vulnerabilities. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' - CVE-2016-5660Accela Civic Platform Citizen Access portal contains ...

What you need to know: Navigating EU Data Protection changes – EU-US Privacy Shield and EU General Data Protection Regulation

If youre an organization with trans-Atlantic presence that transmits and stores European citizen data e.g. employee payroll & HR data, client & prospect data in the U.S. you will want to pay attention. What we will discuss was administered under the European Unions Data Protection Directive and a...

Iran orders all Messaging Apps to store its citizens' data within Country

Last year, Iran blocked Telegram and many other social networks after their founders refused to help Iranian authorities to spy on their citizens. Now it looks like Iranian government wants tighter controls on all foreign messaging and social media apps operating in the country that will give the...

APT Threat Targets Tibetans, Journalists and Human Rights Workers

Tibetans, journalists and human rights workers in Hong Kong and Taiwan have been targeted in an APT campaign that makes use of Microsoft Rich Text File RTF documents to compromise computers. Researchers say it’s a new strategy by attackers in an ongoing advanced persistent threat that dates back ...

Scarlet Mimic Behind Espionage Campaign Against Tibetan, Uyghur Activists

Researchers believe a single group is responsible for a series of attacks over the years to spy on Tibetan and Uyghur activists. For four years the group has used a cornucopia of spearphishing emails, a watering hole attack, and a backdoor Trojan to carry out espionage. Dubbed Scarlet Mimic, the...

JavaScript-Based DDoS Peaks at 275,000 Requests Per Second

Two years ago at the Black Hat conference, WhiteHat Security researchers Jeremiah Grossman and Matt Johansen explained how hackers could in theory leverage an online ad network to distribute malicious JavaScript efficiently and quickly. Depending on how much money the attacker wanted to spend, th...

Hacking Team Says It Always Sold 'Strictly Within the Law'

Hacking Team officials are disputing reports that the company sold its surveillance and intrusion software to oppressive regimes in countries that were under sanction. The company said it sold its products “strictly within the law and regulation as it applied at the time any sale was made.” The n...