CVE-2021-45901

The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists...

CVE-2021-45901

The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists...

CVE-2021-45901

The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists...

Authentication flaw

The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists...

CVE-2021-45901

The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists...

CVE-2021-45901

The CVE-2021-45901 issue affects ServiceNow Orlando, where the password-reset form returns different responses for invalid authentication depending on username existence, enabling unauthenticated username enumeration. The connected documents include an exploit script and PoC code demonstrating ho...

CVE-2021-45901: Observable Discrepancy

The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists...

A December to Remember — Or, How We Improved InsightAppSec in Q4 in the Midst of Log4Shell

Ho, ho, holy cow — what a wild way to wrap up the year that was. Thousands of flights were cancelled during Christmas week, nearly every holiday party became a super-spreader event, and we lost a legend in Betty White. In our neck of the woods, Log4Shell has been dominating the conversation for...

A Dream Team-Up: Integrate InsightAppSec With ServiceNow ITSM

At Rapid7, we are constantly improving InsightAppSec and tCell with the goal of making our customers' lives easier. Over the last few months alone, we've improved the way your team structures permissions, integrated with Microsoft's .Net 6.0, and automated authentication to make scan after scan...

Exploit for Observable Discrepancy in Servicenow

CVE-2021-45901 ServiceNow - Username Enumeration !service-...

@eik/core (>=1.0.0-alpha.19, <=1.2.6), @eik/service (>=1.0.0-alpha.13, <=1.2.32) +2 more potentially affected by CVE-2021-27290 via ssri (8.0.0)

ssri NPM version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ssri and may be impacted: - @eik/core =1.0.0-alpha.19, =1.0.0-alpha.13, =26.4.0, =2.4.7, =2.5.4 Source cves: CVE-2021-27290 Source advisory: OSV:GHSA-VX3P-948G-6VHQ...

Security Bulletin: Vulnerability in Apache Commons Codec affects Netcool/OMNIbus CEM Gateway and ServiceNow Gateway

Summary Netcool/OMNIbus CEM Gateway and ServiceNow Gateway are vulnerable to remote attack to obtain sensitive info by exploiting the weakness in Apache Commons Codec. CVE-177835 Vulnerability Details Third Party Entry: 177835 DESCRIPTION: Apache Commons Codec information disclosure CVSS Base...

U.S. Dept Of Defense: PII Leak via /██████

Summary: An attacker is able to access ServiceNow e-mail notification modules via █████/██████████. Once on this page, the attacker can click any of the notifications, select Preview Notification, and choose a user to view their profile data to include Full Name, rank, organization, e-mail addres...

ServiceNow IT Service Management Cross-Site Scripting Vulnerability

ServiceNow IT Service Management ITSM is a set of IT service management tools from ServiceNow, Inc. in the United States. The tool provides incident management, problem management, change and release management and other functions. A cross-site scripting vulnerability exists in ServiceNow IT...

CVE-2019-20768

ServiceNow IT Service Management Kingston through Patch 14-1, London through Patch 7, and Madrid before patch 4 allow stored XSS via crafted sysparmitemguid and sysid parameters in an Incident Request to servicecatalog.do...

Cross site scripting

ServiceNow IT Service Management Kingston through Patch 14-1, London through Patch 7, and Madrid before patch 4 allow stored XSS via crafted sysparmitemguid and sysid parameters in an Incident Request to servicecatalog.do...

CVE-2019-20768

ServiceNow IT Service Management Kingston through Patch 14-1, London through Patch 7, and Madrid before patch 4 allow stored XSS via crafted sysparmitemguid and sysid parameters in an Incident Request to servicecatalog.do...

CVE-2019-20768

CVE-2019-20768 affects ServiceNow IT Service Management ( Kingston through Patch 14-1, London through Patch 7, Madrid before patch 4). The issue is a stored XSS vulnerability triggered by crafted sysparm_item_guid and sys_id parameters in an Incident Request to service_catalog.do. The connected d...

CVE-2019-20768: Improper Neutralization of Input During Web Page Generation

ServiceNow IT Service Management Kingston through Patch 14-1, London through Patch 7, and Madrid before patch 4 allow stored XSS via crafted sysparmitemguid and sysid parameters in an Incident Request to servicecatalog.do...

Phish of GoDaddy Employee Jeopardized Escrow.com, Among Others

A spear-phishing attack this week hooked a customer service employee at GoDaddy.com, the world's largest domain name registrar, KrebsOnSecurity has learned. The incident gave the phisher the ability to view and modify key customer records, access that was used to change domain settings for a...