Servicenow
Monthly
SQL injection in the ServiceNow AI Platform allows an unauthenticated attacker, under certain conditions, to execute arbitrary SQL statements against the instance's underlying database, enabling unauthorized read and modification of instance data beyond intended boundaries. The flaw carries a maximum CVSS 4.0 base score of 10.0 (network, no authentication, high impact to confidentiality, integrity, and availability, with scope-changing impact to subsequent systems). ServiceNow, which self-reported the issue, states it has no public exploit identified at time of analysis and is not currently aware of malicious exploitation.
Improper access control in the ServiceNow AI Platform allows an unauthenticated user, under certain circumstances, to create or modify instance data beyond intended boundaries, resulting in privilege escalation. ServiceNow has patched hosted instances and supplied updates to partners and self-hosted customers; the vendor rates this maximum severity (CVSS 4.0 10.0) but reports no known exploitation. No public exploit identified at time of analysis.
Remote code execution in the ServiceNow AI Platform lets an unauthenticated attacker, under certain unspecified circumstances, inject and run arbitrary code within a ServiceNow instance and read or modify instance data beyond intended authorization boundaries. ServiceNow rates it CVSS 4.0 10.0 (maximum) with a fully unauthenticated network vector and total confidentiality, integrity, and availability impact including subsequent-system impact. There is no public exploit identified at time of analysis, and ServiceNow states it is not currently aware of malicious exploitation.
Remote code execution in ServiceNow Now Platform allows an unauthenticated attacker to escape the platform's scripting sandbox and execute arbitrary code, gaining more access to the instance than intended. ServiceNow rates this maximum severity (CVSS 4.0 base 10.0) and has patched hosted instances while shipping fixes to self-hosted and partner deployments across the Zurich, Australia, Xanadu, and Yokohama release families. No public exploit identified at time of analysis and ServiceNow states it is not aware of malicious exploitation, though the unauthenticated, network-reachable nature makes prompt patching essential.
Remote code execution in the ServiceNow AI Platform allows an unauthenticated attacker, under certain (unspecified) circumstances, to execute arbitrary code within the ServiceNow platform, carrying a critical CVSS 4.0 base score of 9.5. ServiceNow has patched hosted instances directly and issued fixes to self-hosted customers and partners; there is no public exploit identified at time of analysis, and the vendor states it is not currently aware of exploitation. The high CVSS complexity metric (AC:H) indicates the exploit is not trivially reproducible against arbitrary instances, tempering the otherwise maximal impact rating.
ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ServiceNow AI Platform has a user impersonation vulnerability allowing unauthenticated attackers to impersonate any user and perform their authorized actions. ServiceNow has deployed patches to hosted instances and self-hosted updates are available.
ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow Polaris Layout. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Scripting (XSS) vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arbitrary scripts. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics dashboard. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via '${xyz}' Glide Scripting Injection in the sysparm_media parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
ServiceNow ITSM 2016-06-02 has XSS via the First Name or Last Name field of My Profile (aka navpage.do), or the Search bar of My Portal (aka search_results.do). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in the ServiceNow AI Platform allows an unauthenticated attacker, under certain conditions, to execute arbitrary SQL statements against the instance's underlying database, enabling unauthorized read and modification of instance data beyond intended boundaries. The flaw carries a maximum CVSS 4.0 base score of 10.0 (network, no authentication, high impact to confidentiality, integrity, and availability, with scope-changing impact to subsequent systems). ServiceNow, which self-reported the issue, states it has no public exploit identified at time of analysis and is not currently aware of malicious exploitation.
Improper access control in the ServiceNow AI Platform allows an unauthenticated user, under certain circumstances, to create or modify instance data beyond intended boundaries, resulting in privilege escalation. ServiceNow has patched hosted instances and supplied updates to partners and self-hosted customers; the vendor rates this maximum severity (CVSS 4.0 10.0) but reports no known exploitation. No public exploit identified at time of analysis.
Remote code execution in the ServiceNow AI Platform lets an unauthenticated attacker, under certain unspecified circumstances, inject and run arbitrary code within a ServiceNow instance and read or modify instance data beyond intended authorization boundaries. ServiceNow rates it CVSS 4.0 10.0 (maximum) with a fully unauthenticated network vector and total confidentiality, integrity, and availability impact including subsequent-system impact. There is no public exploit identified at time of analysis, and ServiceNow states it is not currently aware of malicious exploitation.
Remote code execution in ServiceNow Now Platform allows an unauthenticated attacker to escape the platform's scripting sandbox and execute arbitrary code, gaining more access to the instance than intended. ServiceNow rates this maximum severity (CVSS 4.0 base 10.0) and has patched hosted instances while shipping fixes to self-hosted and partner deployments across the Zurich, Australia, Xanadu, and Yokohama release families. No public exploit identified at time of analysis and ServiceNow states it is not aware of malicious exploitation, though the unauthenticated, network-reachable nature makes prompt patching essential.
Remote code execution in the ServiceNow AI Platform allows an unauthenticated attacker, under certain (unspecified) circumstances, to execute arbitrary code within the ServiceNow platform, carrying a critical CVSS 4.0 base score of 9.5. ServiceNow has patched hosted instances directly and issued fixes to self-hosted customers and partners; there is no public exploit identified at time of analysis, and the vendor states it is not currently aware of exploitation. The high CVSS complexity metric (AC:H) indicates the exploit is not trivially reproducible against arbitrary instances, tempering the otherwise maximal impact rating.
ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ServiceNow AI Platform has a user impersonation vulnerability allowing unauthenticated attackers to impersonate any user and perform their authorized actions. ServiceNow has deployed patches to hosted instances and self-hosted updates are available.
ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow Polaris Layout. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Scripting (XSS) vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arbitrary scripts. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics dashboard. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via '${xyz}' Glide Scripting Injection in the sysparm_media parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
ServiceNow ITSM 2016-06-02 has XSS via the First Name or Last Name field of My Profile (aka navpage.do), or the Search bar of My Portal (aka search_results.do). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.