ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.
ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.
CVE-2012-4792 is a use-after-free vulnerability in Microsoft Internet Explorer that allows remote attackers to execute arbitrary code by triggering access to an improperly allocated or deleted object, specifically demonstrated with a CDwnBindInfo object. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.
In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.)
VMware vCenter Server has a vulnerability due to incorrect default file permissions that can allow a remote, privileged attacker to access sensitive information. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.
CVE-2024-36401 is a critical remote code execution vulnerability in OSGeo GeoServer GeoTools caused by improper neutralization of directives in dynamically evaluated code. The flaw arises from unsafe evaluation of property names as XPath expressions, allowing unauthenticated attackers to execute arbitrary code remotely. The vulnerability has a CVSS score of 9.8 and is known to be exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2024-38112 is a spoofing vulnerability in the Microsoft Windows MSHTML Platform that impacts confidentiality, integrity, and availability. It has a high severity with a CVSS score of 7.5 and is known to be exploited in the wild. The vulnerability requires user interaction and has a high attack complexity. No specific affected versions or patch information is provided in the available data.
CVE-2024-38080 is a privilege escalation vulnerability in Microsoft Windows Hyper-V that allows a local attacker with user-level permissions to gain SYSTEM privileges. It has a high severity score of 7.8 and has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.
A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary commands as root on the underlying operating system of an affected device.
This vulnerability is due to insufficient validation of arguments that are passed to specific configuration CLI commands. An attacker could exploit this vulnerability by including crafted input as the argument of an affected configuration CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of root.
Note: To successfully exploit this vulnerability on a Cisco NX-OS device, an attacker must have Administrator credentials. The following Cisco devices already allow administrative users to access the underlying operating system through the bash-shell feature, so, for these devices, this vulnerability does not grant any additional privileges:
Nexus 3000 Series Switches
Nexus 7000 Series Switches that are running Cisco NX-OS Software releases 8.1(1) and later
Nexus 9000 Series Switches in standalone NX-OS mode
OSGeo GeoServer JAI-EXT contains a code injection vulnerability (CVE-2022-24816) that can lead to remote code execution when Jiffle scripts are accepted via network requests in programs using jt-jiffle. This vulnerability has been exploited in the wild and is considered high severity.
CVE-2022-2586 is a use-after-free vulnerability in the Linux Kernel's nft_object component that allows local attackers to escalate privileges. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.
CVE-2020-13965 is a high-severity cross-site scripting (XSS) vulnerability in Roundcube Webmail. It allows a remote attacker to manipulate data by sending a malicious XML attachment. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVE-2024-26169 is a high-severity vulnerability in the Microsoft Windows Error Reporting Service that allows a local attacker with user-level permissions to escalate privileges to SYSTEM level. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. It involves improper privilege management, enabling unauthorized privilege escalation without user interaction.
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.