292 matches found
CVE-2022-39048 Cross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment_redirect
A XSS vulnerability was identified in the ServiceNow UI page assessmentredirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks,...
ServiceNow UI 跨站脚本漏洞
ServiceNow UI is the display interface for ServiceNow. A cross-site scripting vulnerability exists in ServiceNow UI, which stems from a cross-site scripting XSS vulnerability...
CVE-2022-39048 Cross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment_redirect
A XSS vulnerability was identified in the ServiceNow UI page assessmentredirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks,...
PT-2023-13678 · Servicenow · Servicenow
Name of the Vulnerable Software and Affected Versions: ServiceNow affected versions not specified Description: A XSS issue was identified in the ServiceNow UI page assessment redirect. To exploit this, an attacker would need to persuade an authenticated user to click a maliciously crafted URL...
CVE-2022-39048
ServiceNow UI cross-site scripting (CVE-2022-39048) affects the assessment_redirect page. The vulnerability allows an authenticated user to be exploited via a crafted URL that injects JavaScript in the sysparm_survey_url parameter, enabling client-side attacks such as phishing and potential CSRF ...
ServiceNow 跨站脚本漏洞
ServiceNow is a cloud computing platform from US-based ServiceNow, Inc. to help companies manage the digital workflow of their business operations. A security vulnerability exists in ServiceNow. An attacker exploiting the vulnerability is able to inject arbitrary scripts...
Automating Vulnerability Management with Qualys VMDR & ServiceNow
With a growing number of cyber-attacks and the push to stay ahead of adversaries, the Vulnerability Management lifecycle has become necessary for ensuring enterprise-grade cyber resiliency. For many organizations, there is a persistent challenge in supporting vulnerability assessment and...
Microsoft shifts to a comprehensive SaaS security solution
Software as a service SaaS apps are ubiquitous, hybrid work is the new normal, and protecting them and the important data they store is a big challenge for organizations. Today, 59 percent of security professionals find the SaaS sprawl challenging to manage1 and have identified cloud...
CVE-2022-42704
A cross-site scripting XSS vulnerability in Employee Service Center esc and Service Portal sp in ServiceNow Quebec, Rome, and San Diego allows remote attackers to inject arbitrary web script via the Standard Ticket Conversations widget...
Cross site scripting
A cross-site scripting XSS vulnerability in Employee Service Center esc and Service Portal sp in ServiceNow Quebec, Rome, and San Diego allows remote attackers to inject arbitrary web script via the Standard Ticket Conversations widget...
ServiceNow San Diego Patch和Rome Patch 跨站脚本漏洞
ServiceNow San Diego Patch and ServiceNow Rome Patch are both products of ServiceNow, Inc.ServiceNow San Diego Patch is a series of patches.ServiceNow Rome Patch is an application patch. ServiceNow San Diego Patch and Rome Patch have a security vulnerability that stems from the presence of...
PT-2023-14143 · Servicenow · Servicenow
Name of the Vulnerable Software and Affected Versions: ServiceNow versions Quebec through San Diego Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script via the Standard Ticket Conversations widget in the Employee Service Center and Service Portal...
CVE-2022-42704
CVE-2022-42704 is a cross-site scripting (XSS) vulnerability in ServiceNow’s Employee Service Center (ESC) and Service Portal (SP) affecting Quebec through San Diego releases. The issue allows remote attackers to inject arbitrary web script via the Standard Ticket Conversations widget, with impac...
CVE-2022-42704
A cross-site scripting XSS vulnerability in Employee Service Center esc and Service Portal sp in ServiceNow Quebec, Rome, and San Diego allows remote attackers to inject arbitrary web script via the Standard Ticket Conversations widget...
CVE-2022-42704
A cross-site scripting XSS vulnerability in Employee Service Center esc and Service Portal sp in ServiceNow Quebec, Rome, and San Diego allows remote attackers to inject arbitrary web script via the Standard Ticket Conversations widget...
U.S. Dept Of Defense: XSS in ServiceNow logout https://████:443
An XSS vulnerability was discovered in ServiceNow logout, allowing an unauthenticated remote attacker to execute code in the user's browser context by clicking on a malicious link. The vulnerability was present in ServiceNow versions prior to SanDiego SP6 and has been assigned CVE-2022-38463...
ServiceNow Logout Cross-Site Scripting
ServiceNow versions prior to San Diego Patch 4b and Patch 6 are affected by a reflected XSS within the logout functionality. This may permit a remote unauthenticated attacker to execute arbitrary JavaScript code in the browser context of the targeted ServiceNow user. No source data...
U.S. Dept Of Defense: XSS DUE TO CVE-2022-38463 in https://████████
Description: During my research, I found one of the host running ServiceNow vulnerable to CVE-2022-38463 . ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality. Impact Attacker is able to steal victims cookies, redirect victim to attacker controlled...
U.S. Dept Of Defense: Reflected XSS at https://██████/
A reflected XSS vulnerability was discovered in the logout functionality of ServiceNow, allowing an unauthenticated remote attacker to execute arbitrary JavaScript code...