Landing Page | ServiceNow Common Vulnerabilities & Exposures (CVE) Security Advisories

ServiceNow Common Vulnerabilities & Exposures (CVE) Overview The advisories below document publicly disclosed Common Vulnerabilities and Exposures (CVEs) in the Now Platform by ServiceNow. Because ServiceNow uses various methods to communicate vulnerability information, patches, and other fixes, customers should review family, security patch, and hotfix release notes, which are available at https://docs.servicenow.com , for a complete list of security patches and fixes per release.

Subscribe for Future Updates If you want to receive notifications when new advisories are added to this article, log in to the Now Support Portal and click on the "Subscribe" feature at the top of the article. If you want to receive notifications on updates made to the below articles, navigate to the article and click the subscribe feature.

If your security team would like to be informed of future updates to this article, please add the relevant contact information to your account's Security Contact, as described here: Managing company contacts on Now Support

Once they have been added, as the security contact user, subscribe to this article.

Responsible Disclosure Current ServiceNow customers should report any security findings using our security findings tracker (NowSupport login required).

Non-ServiceNow customers should use our Responsible Disclosure program to report security findings, more information here .

Advisories KB Number Topic Date Published KB1706072 CVE-2024-8924 - Unauthenticated Blind SQL Injection in Core Platform

2024-10-29 KB1706070 CVE-2024-8923 - Sandbox Escape in Now Platform

2024-10-29 KB1648313 CVE-2024-5217 - Incomplete Input Validation in GlideExpression Script

2024-07-10 KB1648312 CVE-2024-5178 - Incomplete Input Validation in SecurelyAccess API

2024-07-10 KB1645154 CVE-2024-4879 - Jelly Template Injection Vulnerability in ServiceNow UI Macros

2024-07-10 KB1434119 CVE-2023-3442 - Missing Authorization in Jenkins Plug-in for ServiceNow DevOps

2023-07-26 KB1434118 CVE-2023-3414 - Cross-Site Request Forgery (CSRF) in Jenkins Plug-in for ServiceNow DevOps

2023-07-26 KB1310230 CVE-2023-1298 - Cross-Site Scripting (XSS) vulnerability in the NOW User Experience

2023-07-06 KB1303489 CVE-2022-43684 - ACL bypass in Reporting Functionality

2023-06-07 KB1262967 CVE-2023-1209 - Reflected Cross Site Scripting (XSS) in Records

2023-05-23 KB1221892 CVE-2022-39048 - Cross-Site Scripting (XSS) Vulnerability in Assessments

2023-04-05 KB1219857 CVE-2022-46886 - Open Redirect vulnerability found on response list update functionality

2023-04-05 KB1272156 CVE-2022-46389 - Cross-Site Scripting (XSS) vulnerability found on logout functionality

2023-04-05 KB1216141 CVE-2022-42704 - Cross-Site Scripting Vulnerability in Service Catalog Widget

2023-01-06 KB1122640 CVE-2022-38172 - Cross-Site Scripting (XSS) vulnerability in the Performance Analytics dashboard

2022-08-26 KB1156793 CVE-2022-38463 - Cross-Site Scripting (XSS) vulnerability found on logout functionality

2022-08-26