428 matches found
CSRF vulnerability and missing permission check in servicenow-devops allow capturing credentials
servicenow-devops 1.38.0 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing...
CVE-2023-1298
ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting XSS vulnerability that was identified in the ServiceNow Polaris Layout. This vulnerability would enable an authenticated user to inject arbitrary scripts...
Cross site scripting
ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting XSS vulnerability that was identified in the ServiceNow Polaris Layout. This vulnerability would enable an authenticated user to inject arbitrary scripts...
CVE-2023-1298
ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting XSS vulnerability that was identified in the ServiceNow Polaris Layout. This vulnerability would enable an authenticated user to inject arbitrary scripts...
CVE-2023-1298
ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting XSS vulnerability that was identified in the ServiceNow Polaris Layout. This vulnerability would enable an authenticated user to inject arbitrary scripts...
CVE-2023-1298
CVE-2023-1298 affects ServiceNow Polaris Layout. A reflected XSS vulnerability could let an authenticated user inject arbitrary scripts. The CVSS v3.1 base score is 6.1 (Medium); vectors: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Exploitation requires user interaction and has network access, with a ch...
PT-2023-8493 · Servicenow +1 · Servicenow +1
Name of the Vulnerable Software and Affected Versions: HCL BigFix ServiceNow affected versions not specified Description: The issue is related to incorrect code generation management in the ServiceNow Data Flow platform, allowing a remote attacker to execute arbitrary code. A malicious authorized...
PT-2023-16870 · Servicenow · Servicenow
Name of the Vulnerable Software and Affected Versions: ServiceNow affected versions not specified Description: A Reflected Cross-Site scripting XSS vulnerability was identified in the ServiceNow Polaris Layout. This issue would enable an authenticated user to inject arbitrary scripts...
CVE-2023-1298: Improper Neutralization of Input During Web Page Generation
ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting XSS vulnerability that was identified in the ServiceNow Polaris Layout. This vulnerability would enable an authenticated user to inject arbitrary scripts...
CVE-2022-43684
ServiceNow has released patches and an upgrade that address an Access Control List ACL bypass issue in ServiceNow Core functionality. Additional Details This issue is present in the following supported ServiceNow releases: Quebec prior to Patch 10 Hot Fix 8b Rome prior to Patch 10 Hot Fix 1 San...
Authorization
ServiceNow has released patches and an upgrade that address an Access Control List ACL bypass issue in ServiceNow Core functionality. Additional Details This issue is present in the following supported ServiceNow releases: Quebec prior to Patch 10 Hot Fix 8b Rome prior to Patch 10 Hot Fix 1 San...
CVE-2022-43684 ACL bypass in Reporting functionality
ServiceNow has released patches and an upgrade that address an Access Control List ACL bypass issue in ServiceNow Core functionality. Additional Details This issue is present in the following supported ServiceNow releases: Quebec prior to Patch 10 Hot Fix 8b Rome prior to Patch 10 Hot Fix 1 San...
CVE-2022-43684
CVE-2022-43684 describes an ACL bypass in ServiceNow Core functionality. Affected: ServiceNow Quebec (before Patch 10 Hot Fix 8b), Rome (before Patch 10 Hot Fix 1), San Diego (before Patch 7), Tokyo (before Tokyo Patch 1), and Utah (before Utah GA). Impact: authenticated users could access sensit...
CVE-2022-43684 ACL bypass in Reporting functionality
ServiceNow has released patches and an upgrade that address an Access Control List ACL bypass issue in ServiceNow Core functionality. Additional Details This issue is present in the following supported ServiceNow releases: Quebec prior to Patch 10 Hot Fix 8b Rome prior to Patch 10 Hot Fix 1 San...
CVE-2022-43684: Exposure of Sensitive Information to an Unauthorized Actor
ServiceNow has released patches and an upgrade that address an Access Control List ACL bypass issue in ServiceNow Core functionality. Additional Details This issue is present in the following supported ServiceNow releases: Quebec prior to Patch 10 Hot Fix 8b Rome prior to Patch 10 Hot Fix 1 San...
CVE-2023-1209
Cross-Site Scripting XSS vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arbitrary scripts...
CVE-2023-1209
Cross-Site Scripting XSS vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arbitrary scripts...
Cross site scripting
Cross-Site Scripting XSS vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arbitrary scripts...