NP
Product
Now Platform
On CISA KEVExploited in the wild
11
CVEs
2
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 3High 2Medium 6Low 0
Watch
Add Now Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-5217 In wildKEV | 9.8 | Jul 10 | Incomplete Input Validation in GlideExpression Script Affected: before Utah Patch 10 Hot Fix 3; before Utah Patch 10a Hot Fix 2; before Utah Patch 10b Hot Fix 1; before Vancouver Patch 6 Hot Fix 2; before Vancouver Patch 7 Hot Fix 3b; before Vancouver Patch 8 Hot Fix 4; +7 more |
| CVE-2024-4879 In wildKEV | 9.8 | Jul 10 | Jelly Template Injection Vulnerability in ServiceNow UI Macros Affected: before Utah Patch 10 Hot Fix 3; before Utah Patch 10a Hot Fix 2; before Vancouver Patch 6 Hot Fix 2; before Vancouver Patch 7 Hot Fix 3b; before Vancouver Patch 8 Hot Fix 4; before Vancouver Patch 9; +5 more |
| CVE-2024-8923 | 10.0 | Oct 29 | Sandbox Escape in Now Platform Affected: before Vancouver Patch 9 Hot Fix 2a; before Vancouver Patch 10; before Washington DC Patch 4 Hot Fix 1a; before Washington DC Patch 5; before Xanadu GA Release |
| CVE-2025-3648 | 8.2 | Jul 8 | Data Inference in Now Platform via Conditional ACLs Affected: Aspen |
| CVE-2024-8924 | 7.5 | Oct 29 | Unauthenticated Blind SQL Injection in Core Platform Affected: before Utah Patch 10b Hot Fix 3; before Vancouver Patch 8 Hot Fix 5; before Vancouver Patch 9 Hot Fix 3b; before Vancouver Patch 10 Hot Fix 2; before Washington DC Patch 4 Hot Fix 2b; before Washington DC Patch 5 Hot Fix 6; +3 more |
| CVE-2025-0337 | 6.5 | Mar 6 | Authorization bypass in Now Platform Affected: before Washington DC Patch 9; before Xanadu Patch 4; before Yokohama |
| CVE-2022-43684 | 6.5 | Jun 13 | ACL bypass in Reporting functionality Affected: Quebec before Patch 10 Hot Fix 8b; Rome before Patch 10 Hot Fix 1; San Diego before Patch 7; Tokyo before Tokyo Patch 1; Utah before Utah General Availability (GA) |
| CVE-2022-46389 | 6.1 | Apr 17 | Cross-Site Scripting (XSS) vulnerability found on logout functionality Affected: Quebec before Patch 10 Hotfix 11b; Rome before Patch 10 Hotfix 3b; San Diego before Patch 9; Tokyo before Patch 4; Utah before GA |
| CVE-2022-39048 | 6.1 | Apr 10 | Cross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment_redirect Affected: Tokyo before Patch 1a; San Diego before Patch 7b; Rome before Patch 10 Hotfix 2b; Quebec before Patch 10 Hotfix 10b |
| CVE-2024-5178 | 4.9 | Jul 10 | Incomplete Input Validation in SecurelyAccess API Affected: before Utah Patch 10 Hot Fix 3; before Utah Patch 10a Hot Fix 2; before Utah Patch 10b Hot Fix 1; before Vancouver Patch 6 Hot Fix 2; before Vancouver Patch 7 Hot Fix 3b; before Vancouver Patch 8 Hot Fix 4; +6 more |
| CVE-2024-5890 | 4.3 | Dec 2 | HTML Injection in the Assessment plugin Affected: before Utah Patch 8 Hot Fix 1; before Vancouver Patch 10; before Vancouver Patch 9; before Washington DC Early Access |
Showing 11