snowpick

snowpick es un escáner de exposición de ServiceNow que detecta ACL de widgets mal configuradas, controles de acceso de la API REST y exposición de datos no autenticada. ServiceNow expone datos a través de dos superficies públicas comunes: los widgets de Service Portal y la API REST de tablas...

faraday_plugins

Install pip install faraday-plugins Commands List Plugins List all plugins and if its compatible with command or/and report Optional params: -cpf / --custom-plugins-folder PATH: If given will also look for custom plugins on that path faraday-plugins list-plugins Test autodetect plugin from comman...

CVE-2024-4879

CVE-2024-4879 CVE-2024-4879.py es un script de Python diseñado para detectar vulnerabilidades específicas en instancias de ServiceNow y volcar los detalles de conexión a la base de datos si se encuentra la vulnerabilidad. Esta herramienta es especialmente útil para investigadores de seguridad y...

CVE-2024-4879

CVE-2024-4879 针对ServiceNow CVE-2024-4879漏洞的批量扫描工具。 概述 该工具专为批量扫描ServiceNow CVE-2024-4879漏洞而设计。其灵感来自Assetnote的安全研究，该研究详细介绍了近期的ServiceNow CVE-2024-4879、CVE-2024-5178和CVE-2024-5217漏洞。 使用方法 最低要求 Python 3.6 或更高版本 requests 库 单个目标： python CVE-2024-4879.py -u https://target:9090 批量扫描： python...

ServiceNow - Cross-Site Scripting

ServiceNow through San Diego Patch 4b and Patch 6 contains a cross-site scripting vulnerability in the logout functionality, which can enable an unauthenticated remote attacker to execute arbitrary JavaScript. id: CVE-2022-38463 info: name: ServiceNow - Cross-Site Scripting author: amanrawat...

ServiceNow - Cross-site Scripting

A XSS vulnerability was identified in the ServiceNow UI page assessmentredirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks,...

CVE-2024-4879

Jelly 模板注入漏洞 in ServiceNow | POC CVE-2024-4879 描述： ServiceNow 已修复在 Vancouver 和 Washington, D.C. Now Platform 版本中发现的一个输入验证漏洞。该漏洞可能允许未经认证的用户在 Now Platform 上下文中远程执行代码。 FOFA : "server : servicenow" 克隆仓库： git clone https://github.com/fa-rrel/CVE-2024-4879.git cd CVE-2024-4879 使用 Nuclei： 单个目标： nuclei -...

CVE-2024-4879

CVE-2024-4879 ServiceNow，一个广泛用于业务转型的平台，近期披露了三个可能对全球组织机构造成严重后果的关键安全漏洞。这些漏洞被标识为 CVE-2024–4879、CVE-2024–5217 和 CVE-2024–5178，影响 Now Platform 的多个版本。 其中最为危险的缺陷是 CVE-2024–4879 和 CVE-2024–5217，它们分别具有 9.3 和 9.2 的严重 CVSSv4 评分。这些漏洞使未经身份验证的远程攻击者能够在 Now Platform 中执行任意代码，可能导致系统完全被攻陷、数据被盗以及关键业务运营中断。 Dorking FO...

CVE-2024-4879-ServiceNow

CVE-2024-4879-ServiceNow ServiceNow 是一个业务转型平台，帮助企业管理工作流程的数字化运营。 CVE-2024-4879 可能允许未经身份验证的用户在 Now Platform 中远程执行代码。该漏洞通过串联利用三个问题：标题注入、模板注入绕过和文件系统过滤器绕过，来访问 ServiceNow 数据。 受影响版本包括 Vancouver、Washington DC Now 和 Utah 平台版本。 使用方法： python3 exploit.py -i 使用示例： python3 exploit.py -i 127.0.0.1...

sh00t

A Testing Environment for Manual Security Testers Sh00t is a task manager to let you focus on performing security testing provides To Do checklists of test cases helps to create bug reports with customizable bug templates Features: Dynamic Task Manager to replace simple editors or task management...

CVE-2024-4879-CVE-2024-5217-ServiceNow-RCE-Scanning

CVE-2024-4879 和 CVE-2024-5217 ServiceNow RCE 扫描 使用 Nuclei 和 Shodan Dork 扫描 CVE-2024-4879 和 CVE-2024-5217 ServiceNow RCE 漏洞。 漏洞信息资源 https://www.assetnote.io/resources/research/chaining-three-bugs-to-access-all-your-servicenow-data 使用方法 nuclei -t CVE-2024-4879-Detect-Database-ServiceNow.yaml -l...

ServiceNow-CVE-2025-11449-CVE-2025-11450-Mitigation-Script

Script de Mitigación para ServiceNow CVE-2025-11449 y CVE-2025-11450 Descripción General Este script detecta y corrige automáticamente las vulnerabilidades de seguridad CVE-2025-11449 y CVE-2025-11450 en los UI Macros de ServiceNow. Estas vulnerabilidades podrían permitir la ejecución arbitraria ...

CVE-2024-4879-ServiceNow

CVE-2024-4879-ServiceNow ServiceNow es una plataforma para la transformación empresarial que ayuda a las empresas a gestionar flujos de trabajo digitales para operaciones empresariales. CVE-2024-4879 podría permitir que un usuario no autenticado ejecute código de forma remota dentro de la...

CVE-2026-103258

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and ServiceNow nodes that allows attackers to bypass filters by breaking out of query literals. Attackers can exploit this by binding vulnerable node parameter...

CVE-2026-103258 n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and ServiceNow nodes that allows attackers to bypass filters by breaking out of query literals. Attackers can exploit this by binding vulnerable node parameter...

EUVD-2026-90652

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and ServiceNow nodes that allows attackers to bypass filters by breaking out of query literals. Attackers can exploit this by binding vulnerable node parameter...

CVE-2026-103258

The n8n workflow automation tool (versions before 2.39.6 and 2.40.x before 2.40.1 ) is vulnerable to a filter bypass due to unescaped parameter interpolation in the SendGrid , Freshservice , and ServiceNow nodes. By binding vulnerable node parameters to untrusted external input, an attacker can b...

CVE-2026-103258 n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and ServiceNow nodes that allows attackers to bypass filters by breaking out of query literals. Attackers can exploit this by binding vulnerable node parameter...

CYBERDUDEBIVASH-ServiceNow-AI-Agent-Audit-Script

CYBERDUDEBIVASH ServiceNow AI Agent 审计脚本 v1.1（2026年1月） 保护您的AI未来 – 企业级审计工具，附带2026更新 该脚本审计ServiceNow AI Agent中的漏洞（如CVE-2025-12420）、治理差距和合规风险。由CYBERDUDEBIVASH驱动 – 您的全球网络安全、AI应用、服务和咨询生态系统。 定价 ：基础版（99美元/许可），企业版（499美元以上，含支持/定制）。联系获取批量优惠！ v1.1 新特性 针对CVE-2025-12420的冒充风险检查。 智能体AI治理审计（透明度、超自动化）。...

aisecplus-week01-servicenow-ai-security-incident

AISec Plus Week01 - Mapa de la Amenaza Investigación de Incidentes de Seguridad en IA: Vulnerabilidad del Virtual Agent de ServiceNow CVE-2025-12420 ¿Qué Ocurrió? Se descubrió una vulnerabilidad crítica en la plataforma de IA de ServiceNow que permitía a un atacante no autenticado hacerse pasar p...