Read the docs

Proofpoint

Records47All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high19CVSS 7.0–8.9

Exploited now

Proofpoint records in CISA KEV

No Proofpoint vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Enterprise Protection 12 records MEDIUM Insider Threat Management 12 records MEDIUM Insider Threat Management Server 10 records MEDIUM Messaging Security Gateway 5 records LOW Protection Server 5 records LOW Threat Response Auto Pull 2 records LOW Email Protection 1 record LOW Proofpoint Protection Server 1 record LOW

Records

12 records in Enterprise Protection · all components

TI-2023-00086 CVE-2023-0090 · GHSA-fqgc-xggw-mh6h

Proofpoint Enterprise Protection webservices unauthenticated RCE

Priority MEDIUM 44

The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote code through 'eval injection'.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00744 Published 2023-03-08 No fix listed CWE-95
TI-2022-22879 CVE-2022-46332 · GHSA-pprc-x7gw-vfvv

Proofpoint Enterprise Protection (PPS/PoD) XSS in "Attachment Names"

Priority MEDIUM 42

The Admin Smart Search feature in Proofpoint Enterprise Protection (PPS/PoD) contains a stored cross-site scripting vulnerability that enables an anonymous email sender to gain admin privileges within the user interface.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00658 Published 2022-12-06 No fix listed CWE-79
TI-2023-00085 CVE-2023-0089 · GHSA-hf6p-499m-7h88

Proofpoint Enterprise Protection webutils authenticated RCE

Priority MEDIUM 41

The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticated user to execute remote code through 'eval injection'.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00739 Published 2023-03-08 No fix listed CWE-95
TI-2022-22880 CVE-2022-46333 · GHSA-hhx8-89hq-cw9c

Proofpoint Enterprise Protection perl eval() arbitrary command execution

Priority LOW 37

The admin user interface in Proofpoint Enterprise Protection (PPS/PoD) contains a command injection vulnerability that enables an admin to execute commands beyond their allowed scope.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01511 Published 2022-12-06 No fix listed CWE-94
TI-2022-22881 CVE-2022-46334 · GHSA-29gp-96hf-p856

Proofpoint Enterprise Protection Local Privilege Escalation

Priority LOW 35

Proofpoint Enterprise Protection (PPS/PoD) contains a vulnerability which allows the pps user to escalate to root privileges due to unnecessary permissions.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00171 Published 2022-12-21 No fix listed CWE-269
TI-2023-05308 CVE-2023-5770 · GHSA-q8q6-ccrm-hrm9

HTML injection in email body through email subject

Priority LOW 30

Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.0034 Published 2024-01-09 Fixed in patch 4809, patch 4805 +1 CWE-838
TI-2024-09856 CVE-2024-10635 · GHSA-47r3-rvvm-8c7f

Enterprise Protection S/MIME Opaque Signature Attachment Scanning Bypass

Priority LOW 27

Enterprise Protection contains an improper input validation vulnerability in attachment defense that allows an unauthenticated remote attacker to bypass attachment scanning security policy by sending a malicious S/MIME a…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00312 Published 2025-04-28 Fixed in patch 5110, patch 5134 +1 CWE-754
TI-2023-05309 CVE-2023-5771 · GHSA-m8wv-7jj8-p8pv

HTML injection in AdminUI through email subject

Priority LOW 27

Proofpoint Enterprise Protection contains a stored XSS vulnerability in the AdminUI.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00391 Published 2023-11-06 Fixed in patch 4796, patch 4795 CWE-79
Open these records in search →