PT-2019-11280

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk version 9.3 Description: The issue allows session hijacking and privilege escalation. This occurs when an established guest session is automatically converted into an established administrator session. The...

CVE-2019-10008: Session Fixation

Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ logi...

CVE-2019-10273

Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account...

CVE-2019-10273: Improper Authentication

Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account...

PT-2019-11677

Name of the Vulnerable Software and Affected Versions ManageEngine ServiceDesk Plus version 9.3 Description The issue is related to information leakage in the "/mc login" API endpoint, allowing authenticated users to enumerate active users due to a flaw in authentication handling. This enables an...