Servicenow Ai Platform
Monthly
SQL injection in the ServiceNow AI Platform allows an unauthenticated attacker, under certain conditions, to execute arbitrary SQL statements against the instance's underlying database, enabling unauthorized read and modification of instance data beyond intended boundaries. The flaw carries a maximum CVSS 4.0 base score of 10.0 (network, no authentication, high impact to confidentiality, integrity, and availability, with scope-changing impact to subsequent systems). ServiceNow, which self-reported the issue, states it has no public exploit identified at time of analysis and is not currently aware of malicious exploitation.
Improper access control in the ServiceNow AI Platform allows an unauthenticated user, under certain circumstances, to create or modify instance data beyond intended boundaries, resulting in privilege escalation. ServiceNow has patched hosted instances and supplied updates to partners and self-hosted customers; the vendor rates this maximum severity (CVSS 4.0 10.0) but reports no known exploitation. No public exploit identified at time of analysis.
Remote code execution in the ServiceNow AI Platform lets an unauthenticated attacker, under certain unspecified circumstances, inject and run arbitrary code within a ServiceNow instance and read or modify instance data beyond intended authorization boundaries. ServiceNow rates it CVSS 4.0 10.0 (maximum) with a fully unauthenticated network vector and total confidentiality, integrity, and availability impact including subsequent-system impact. There is no public exploit identified at time of analysis, and ServiceNow states it is not currently aware of malicious exploitation.
Remote code execution in the ServiceNow AI Platform allows an unauthenticated attacker, under certain (unspecified) circumstances, to execute arbitrary code within the ServiceNow platform, carrying a critical CVSS 4.0 base score of 9.5. ServiceNow has patched hosted instances directly and issued fixes to self-hosted customers and partners; there is no public exploit identified at time of analysis, and the vendor states it is not currently aware of exploitation. The high CVSS complexity metric (AC:H) indicates the exploit is not trivially reproducible against arbitrary instances, tempering the otherwise maximal impact rating.
SQL injection in the ServiceNow AI Platform allows an unauthenticated attacker, under certain conditions, to execute arbitrary SQL statements against the instance's underlying database, enabling unauthorized read and modification of instance data beyond intended boundaries. The flaw carries a maximum CVSS 4.0 base score of 10.0 (network, no authentication, high impact to confidentiality, integrity, and availability, with scope-changing impact to subsequent systems). ServiceNow, which self-reported the issue, states it has no public exploit identified at time of analysis and is not currently aware of malicious exploitation.
Improper access control in the ServiceNow AI Platform allows an unauthenticated user, under certain circumstances, to create or modify instance data beyond intended boundaries, resulting in privilege escalation. ServiceNow has patched hosted instances and supplied updates to partners and self-hosted customers; the vendor rates this maximum severity (CVSS 4.0 10.0) but reports no known exploitation. No public exploit identified at time of analysis.
Remote code execution in the ServiceNow AI Platform lets an unauthenticated attacker, under certain unspecified circumstances, inject and run arbitrary code within a ServiceNow instance and read or modify instance data beyond intended authorization boundaries. ServiceNow rates it CVSS 4.0 10.0 (maximum) with a fully unauthenticated network vector and total confidentiality, integrity, and availability impact including subsequent-system impact. There is no public exploit identified at time of analysis, and ServiceNow states it is not currently aware of malicious exploitation.
Remote code execution in the ServiceNow AI Platform allows an unauthenticated attacker, under certain (unspecified) circumstances, to execute arbitrary code within the ServiceNow platform, carrying a critical CVSS 4.0 base score of 9.5. ServiceNow has patched hosted instances directly and issued fixes to self-hosted customers and partners; there is no public exploit identified at time of analysis, and the vendor states it is not currently aware of exploitation. The high CVSS complexity metric (AC:H) indicates the exploit is not trivially reproducible against arbitrary instances, tempering the otherwise maximal impact rating.