Advisories · Technology
ServiceNow Now Platform.
Every CVE that names ServiceNow Now Platform among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.2 High
Data Inference in Now Platform via Conditional ACLs
- ServiceNow Now Platform
- CWE-1220
- CVSS 7.1 High
Authorization bypass in Now Platform
- ServiceNow Now Platform
- Broken access control
- CVSS 5.1 Medium
HTML Injection in the Assessment plugin
- ServiceNow Now Platform
- Cross-site scripting (XSS)
- CVSS 8.7 High
Unauthenticated Blind SQL Injection in Core Platform
- ServiceNow Now Platform
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Sandbox Escape in Now Platform
- ServiceNow Now Platform
- Code injection
- CVSS 9.2 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
Incomplete Input Validation in GlideExpression Script
- ServiceNow Now Platform
- CWE-184
- CVSS 6.9 Medium
Incomplete Input Validation in SecurelyAccess API
- ServiceNow Now Platform
- CWE-184
- CVSS 9.3 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
Jelly Template Injection Vulnerability in ServiceNow UI Macros
- ServiceNow Now Platform
- CWE-1287
- CVSS 9.9 CriticalCritical · CVSS 9+
ACL bypass in Reporting functionality
- ServiceNow Now Platform
- Information disclosure
- CVSS 6.1 Medium
Cross-Site Scripting (XSS) vulnerability found on logout functionality
- ServiceNow Now Platform
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment_redirect
- Servicenow Now Platform
- Cross-site scripting (XSS)