ServiceNow

ServiceNow unauthenticated API flaw exposed customer instance data

ServiceNow notified impacted customers that an API endpoint set not to require authentication allowed access to instance data such as support tickets, employee records and configuration details. It patched the endpoint on June 5, weeks after a similar bug bounty report, and later suggested researchers rather than criminals were involved.