ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality.
CWE-79