Proofpoint - vulnerabilities (CVEs)

47 CVEs in 12 products, 0 in the last 30 days, newest from 2025-11-03.

Products

Enterprise Protection - 13 CVEs
Insider Threat Management - 12 CVEs
Insider Threat Management Server - 11 CVEs
Messaging Security Gateway - 5 CVEs
Protection Server - 5 CVEs
Itm Server - 3 CVEs
Proofpoint Enterprise Protection - 2 CVEs
Threat Response Auto Pull - 2 CVEs
Email Protection - 1 CVEs
Insider Threat Management Itm Server - 1 CVEs
Proofpoint Protection Server - 1 CVEs
Spam Engine - 1 CVEs

Newest CVEs of Proofpoint

CVE-2025-8558 - CVSS 5.4 (medium), 2025-11-03: Insider Threat Management (ITM) Server versions prior to 7.17.2 contain an authentication bypass vulnerability that allows unauthenticated users on an…
CVE-2024-10635 - CVSS 6.1 (medium), 2025-04-28: Enterprise Protection contains an improper input validation vulnerability in attachment defense that allows an unauthenticated remote attacker to bypass…
CVE-2025-0431 - CVSS 5.8 (medium), 2025-03-19: Enterprise Protection contains a vulnerability in URL rewriting that allows an unauthenticated remote attacker to send an email which bypasses URL protections…
CVE-2024-3676 - CVSS 7.5 (high), 2024-05-14: The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains an Improper Input Validation vulnerability that allows an unauthenticated…
CVE-2024-0862 - CVSS 5 (medium), 2024-05-14: The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains a Server-Side Request Forgery vulnerability that allows an authenticated user…
CVE-2023-5770 - CVSS 5.4 (medium), 2024-01-09: Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded…
CVE-2023-5771 - CVSS 6.1 (medium), 2023-11-06: Proofpoint Enterprise Protection contains a stored XSS vulnerability in the AdminUI. An unauthenticated attacker can send a specially crafted email with HTML…
CVE-2023-4802 - CVSS 4.8 (medium), 2023-09-13: A reflected cross-site scripting vulnerability in the UpdateInstalledSoftware endpoint of the Insider Threat Management (ITM) Server's web console could be…
CVE-2023-4828 - CVSS 6.4 (medium), 2023-09-13: An improper check for an exceptional condition in the Insider Threat Management (ITM) Server could be used by an attacker to change the server's configuration…
CVE-2023-4803 - CVSS 4.8 (medium), 2023-09-13: A reflected cross-site scripting vulnerability in the WriteWindowTitle endpoint of the Insider Threat Management (ITM) Server's web console could be used by…
CVE-2023-4801 - CVSS 7.5 (high), 2023-09-13: An improper certification validation vulnerability in the Insider Threat Management (ITM) Agent for MacOS could be used by an anonymous actor on an adjacent…
CVE-2023-36000 - CVSS 6.5 (medium), 2023-06-27: A missing authorization check in the MacOS agent configuration endpoint of the Insider Threat Management Server enables an anonymous attacker on an adjacent…
CVE-2023-36002 - CVSS 4.3 (medium), 2023-06-27: A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent…
CVE-2023-35998 - CVSS 4.6 (medium), 2023-06-27: A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on an adjacent network to read and write…
CVE-2023-2818 - CVSS 5.5 (medium), 2023-06-27: An insecure filesystem permission in the Insider Threat Management Agent for Windows enables local unprivileged users to disrupt agent monitoring. All…
CVE-2023-2820 - CVSS 6.8 (medium), 2023-06-14: An information disclosure vulnerability in the faye endpoint in Proofpoint Threat Response / Threat Response Auto-Pull (PTR/TRAP) could be used by an attacker…
CVE-2023-2819 - CVSS 4.3 (medium), 2023-06-14: A stored cross-site scripting vulnerability in the Sources UI in Proofpoint Threat Response/ Threat Response Auto Pull (PTR/TRAP) could allow an authenticated…
CVE-2023-0090 - CVSS 9.8 (critical), 2023-03-08: The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote code through 'eval…
CVE-2023-0089 - CVSS 8.8 (high), 2023-03-08: The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticated user to execute remote code through 'eval…
CVE-2022-46334 - CVSS 7.8 (high), 2022-12-21: Proofpoint Enterprise Protection (PPS/PoD) contains a vulnerability which allows the pps user to escalate to root privileges due to unnecessary permissions.…
CVE-2022-46333 - CVSS 7.2 (high), 2022-12-06: The admin user interface in Proofpoint Enterprise Protection (PPS/PoD) contains a command injection vulnerability that enables an admin to execute commands…
CVE-2022-46332 - CVSS 9.6 (critical), 2022-12-06: The Admin Smart Search feature in Proofpoint Enterprise Protection (PPS/PoD) contains a stored cross-site scripting vulnerability that enables an anonymous…
CVE-2021-31608 - CVSS 4.3 (medium), 2022-11-17: Proofpoint Enterprise Protection before 18.8.0 allows a Bypass of a Security Control.
CVE-2022-25294 - CVSS 7.8 (high), 2022-03-10: Proofpoint Insider Threat Management Agent for Windows relies on an inherently dangerous function that could enable an unprivileged local Windows user to run…
CVE-2021-40843 - CVSS 7.3 (high), 2021-10-13: Proofpoint Insider Threat Management Server contains an unsafe deserialization vulnerability in the Web Console. An attacker with write access to the local…
CVE-2021-40842 - CVSS 9.8 (critical), 2021-10-13: Proofpoint Insider Threat Management Server contains a SQL injection vulnerability in the Web Console. The vulnerability exists due to improper input…
CVE-2021-34814 - CVSS 7.5 (high), 2021-10-13: Proofpoint Spam Engine before 8.12.0-2106240000 has a Security Control Bypass.
CVE-2021-39304 - CVSS 7.5 (high), 2021-10-13: Proofpoint Enterprise Protection before 8.12.0-2108090000 allows security control bypass.
CVE-2020-14009 - CVSS 6.3 (medium), 2021-05-07: Proofpoint Enterprise Protection (PPS/PoD) before 8.16.4 contains a vulnerability that could allow an attacker to deliver an email message with a malicious…
CVE-2021-27900 - CVSS 8.1 (high), 2021-04-06: The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is missing an authorization check on several pages in the Web Console. This…