SE
Product
Servicenow
On CISA KEVExploited in the wild
15
CVEs
2
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 3High 2Medium 10Low 0
Watch
Add Servicenow to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-5217 In wildKEV | 9.8 | Jul 10 | Incomplete Input Validation in GlideExpression Script Affected: utah; utah; utah; utah; utah; utah; +34 more |
| CVE-2024-4879 In wildKEV | 9.8 | Jul 10 | Jelly Template Injection Vulnerability in ServiceNow UI Macros Affected: utah; utah; utah; utah; utah; utah; +34 more |
| CVE-2024-8923 | 10.0 | Oct 29 | ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform Affected: xanadu; xanadu; washington_dc; washington_dc; washington_dc; washington_dc; +34 more |
| CVE-2018-7748 | 8.8 | Aug 3 | report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via '${xyz}' Glide Scripting Injection in the sysparm_media… Affected: jakarta; jakarta; jakarta; jakarta; jakarta; jakarta; +6 more |
| CVE-2024-8924 | 7.5 | Oct 29 | ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform Affected: xanadu; xanadu; xanadu; vancouver; vancouver; vancouver; +34 more |
| CVE-2022-43684 | 6.5 | Jun 13 | ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality Affected: quebec; quebec; quebec; quebec; quebec; quebec; +34 more |
| CVE-2023-1298 | 6.1 | Jul 6 | ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow Polaris Layout Affected: san_diego; san_diego; san_diego; san_diego; san_diego; san_diego; +34 more |
| CVE-2022-46389 | 6.1 | Apr 17 | There exists a reflected XSS within the logout functionality of ServiceNow versions lower than Quebec Patch 10 Hotfix 11b, Rome Patch 10 Hotfix 3b, San Diego Patch 9, Tokyo Patch… Affected: quebec; rome; rome; rome; rome; rome; +34 more |
| CVE-2022-46886 | 6.1 | Apr 14 | There exists an open redirect within the response list update functionality of ServiceNow Affected: quebec; quebec; rome; rome; rome; rome; +34 more |
| CVE-2022-39048 | 6.1 | Apr 10 | A XSS vulnerability was identified in the ServiceNow UI page assessment_redirect Affected: quebec; quebec; rome; rome; rome; rome; +34 more |
| CVE-2022-38463 | 6.1 | Aug 23 | ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality Affected: san_diego; san_diego; san_diego |
| CVE-2022-38172 | 6.1 | Aug 23 | ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics dashboard Affected: san_diego; san_diego; san_diego; san_diego; san_diego; san_diego; +1 more |
| CVE-2023-1209 | 5.4 | May 23 | Cross-Site Scripting (XSS) vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arbitrary scripts Affected: rome; rome; rome; rome; rome; rome; +34 more |
| CVE-2022-42704 | 5.4 | Jan 13 | A cross-site scripting (XSS) vulnerability in Employee Service Center (esc) and Service Portal (sp) in ServiceNow Quebec, Rome, and San Diego allows remote attackers to inject… Affected: quebec; rome; rome; rome; rome; rome; +1 more |
| CVE-2021-45901 | 5.3 | Feb 10 | The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists Affected: jakarta; jakarta; jakarta; jakarta; jakarta; jakarta; +1 more |
Showing 15