Vulnerabilities

TI-2021-13404 CVE-2021-34369 · GHSA-vf96-5gw2-gvj4

portlets/contact/ref/refContactDetail.do in Accela Civic Platform through 20.1 allows…

MEDIUM 40

portlets/contact/ref/refContactDetail.do in Accela Civic Platform through 20.1 allows remote attackers to obtain sensitive information via a modified contactSeqNumber value.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.08236 Published 2021-06-09 No fix listed

TI-2021-13405 CVE-2021-34370 · GHSA-m5fq-23j5-h7j7

Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS.

MEDIUM 40

Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.09996 Published 2021-06-09 No fix listed CWE-79

TI-2021-13216 CVE-2021-33904 · GHSA-w8x8-8rp7-r92g

In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode…

MEDIUM 40

In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.09972 Published 2021-06-07 No fix listed CWE-79

TI-2016-04916 CVE-2016-5660 · GHSA-7xrp-7vm5-7qjw

Cross-site scripting (XSS) vulnerability in AttachmentsList.aspx in Accela Civic Platform…

LOW 31

Cross-site scripting (XSS) vulnerability in AttachmentsList.aspx in Accela Civic Platform Citizen Access portal allows remote attackers to inject arbitrary web script or HTML via the iframeid parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01664 Published 2016-07-15 No fix listed CWE-79

Vulnerabilities

Filters

portlets/contact/ref/refContactDetail.do in Accela Civic Platform through 20.1 allows…

Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS.

In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode…

Cross-site scripting (XSS) vulnerability in AttachmentsList.aspx in Accela Civic Platform…