NP
Product
Now Platform
On CISA KEVExploited in the wild
11
CVEs
2
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 3High 2Medium 6Low 0
Watch
Add Now Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-0337 | 6.5 | Mar 6 | Authorization bypass in Now Platform Affected: before Washington DC Patch 9; before Xanadu Patch 4; before Yokohama |
| CVE-2022-43684 | 6.5 | Jun 13 | ACL bypass in Reporting functionality Affected: Quebec before Patch 10 Hot Fix 8b; Rome before Patch 10 Hot Fix 1; San Diego before Patch 7; Tokyo before Tokyo Patch 1; Utah before Utah General Availability (GA) |
| CVE-2022-46389 | 6.1 | Apr 17 | Cross-Site Scripting (XSS) vulnerability found on logout functionality Affected: Quebec before Patch 10 Hotfix 11b; Rome before Patch 10 Hotfix 3b; San Diego before Patch 9; Tokyo before Patch 4; Utah before GA |
| CVE-2022-39048 | 6.1 | Apr 10 | Cross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment_redirect Affected: Tokyo before Patch 1a; San Diego before Patch 7b; Rome before Patch 10 Hotfix 2b; Quebec before Patch 10 Hotfix 10b |
| CVE-2024-5178 | 4.9 | Jul 10 | Incomplete Input Validation in SecurelyAccess API Affected: before Utah Patch 10 Hot Fix 3; before Utah Patch 10a Hot Fix 2; before Utah Patch 10b Hot Fix 1; before Vancouver Patch 6 Hot Fix 2; before Vancouver Patch 7 Hot Fix 3b; before Vancouver Patch 8 Hot Fix 4; +6 more |
| CVE-2024-5890 | 4.3 | Dec 2 | HTML Injection in the Assessment plugin Affected: before Utah Patch 8 Hot Fix 1; before Vancouver Patch 10; before Vancouver Patch 9; before Washington DC Early Access |
Showing 6