Search
Search Results (32 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-46886 | 1 Servicenow | 1 Servicenow | 2025-02-06 | 5.5 Medium |
| There exists an open redirect within the response list update functionality of ServiceNow. This allows attackers to redirect users to arbitrary domains when clicking on a URL within a service-now domain. | ||||
| CVE-2022-46389 | 1 Servicenow | 1 Servicenow | 2025-02-06 | 6.1 Medium |
| There exists a reflected XSS within the logout functionality of ServiceNow versions lower than Quebec Patch 10 Hotfix 11b, Rome Patch 10 Hotfix 3b, San Diego Patch 9, Tokyo Patch 4, and Utah GA. This enables an unauthenticated remote attacker to execute arbitrary JavaScript code in the browser-based web console. | ||||
| CVE-2023-1209 | 1 Servicenow | 1 Servicenow | 2025-01-17 | 4.3 Medium |
| Cross-Site Scripting (XSS) vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arbitrary scripts. | ||||
| CVE-2023-1298 | 1 Servicenow | 1 Servicenow | 2024-12-17 | 4.3 Medium |
| ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow Polaris Layout. This vulnerability would enable an authenticated user to inject arbitrary scripts. | ||||
| CVE-2024-8924 | 1 Servicenow | 1 Servicenow | 2024-11-27 | 7.5 High |
| ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to extract unauthorized information. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes. | ||||
| CVE-2024-8923 | 1 Servicenow | 1 Servicenow | 2024-11-27 | 9.8 Critical |
| ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow deployed an update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes. | ||||
| CVE-2022-38463 | 1 Servicenow | 1 Servicenow | 2024-11-21 | 6.1 Medium |
| ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality. | ||||
| CVE-2022-38172 | 1 Servicenow | 1 Servicenow | 2024-11-21 | 6.1 Medium |
| ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics dashboard. | ||||
| CVE-2021-45901 | 1 Servicenow | 1 Servicenow | 2024-11-21 | 5.3 Medium |
| The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists. | ||||
| CVE-2019-20768 | 1 Servicenow | 1 It Service Management | 2024-11-21 | 5.4 Medium |
| ServiceNow IT Service Management Kingston through Patch 14-1, London through Patch 7, and Madrid before patch 4 allow stored XSS via crafted sysparm_item_guid and sys_id parameters in an Incident Request to service_catalog.do. | ||||
| CVE-2018-8720 | 1 Servicenow | 1 It Service Management | 2024-11-21 | N/A |
| ServiceNow ITSM 2016-06-02 has XSS via the First Name or Last Name field of My Profile (aka navpage.do), or the Search bar of My Portal (aka search_results.do). | ||||
| CVE-2018-7748 | 1 Servicenow | 1 Servicenow | 2024-11-21 | N/A |
| report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via '${xyz}' Glide Scripting Injection in the sysparm_media parameter. | ||||