CVE-2021-40842: Improper Neutralization of Special Elements used in an SQL Command

Proofpoint Insider Threat Management Server contains a SQL injection vulnerability in the Web Console. The vulnerability exists due to improper input validation on the database name parameter required in certain unauthenticated APIs. A malicious URL visited by anyone with network access to the...

Cobalt Strike Usage Explodes Among Cybercrooks

The use of Cobalt Strike – the legitimate, commercially available tool used by network penetration testers – by cybercrooks has shot through the roof, according to Proofpoint researchers, who say that the tool has now “gone fully mainstream in the crimeware world.” The researchers have tracked a...

com.proofpoint.discovery:discovery-server (1.1), com.proofpoint.discovery:elb (1.0) +21 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (8.0.1.v20110908)

org.eclipse.jetty:jetty-servlets MAVEN version 8.0.1.v20110908 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - com.proofpoint.discovery:discovery-server 1.1 - com.proofpoint.discovery:elb 1.0 -...

com.proofpoint.discovery:discovery-elb (1.1), com.proofpoint.galaxy:galaxy-agent (0.7) +25 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (8.0.3.v20111011)

org.eclipse.jetty:jetty-servlets MAVEN version 8.0.3.v20111011 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - com.proofpoint.discovery:discovery-elb 1.1 - com.proofpoint.galaxy:galaxy-agent 0.7 -...

Proofpoint Insider Threat Management Server Remote Code Execution Vulnerability

Proofpoint Insider Threat Management Server is a server-side application from Proofpoint, Inc. for preventing malicious operations by enterprise insiders. A remote code execution vulnerability exists in the WriteWindowMouse API in Proofpoint Insider Threat Management Server versions prior to 7.9....

Proofpoint Insider Threat Management Server Remote Code Execution Vulnerability (CNVD-2021-36665)

Proofpoint Insider Threat Management Server is a server-side application from Proofpoint, Inc. for preventing malicious operations by enterprise insiders. A remote code execution vulnerability exists in the WriteImage API of Proofpoint Insider Threat Management Server versions prior to 7.9.1. The...

Proofpoint Insider Threat Management Server Remote Code Execution Vulnerability (CNVD-2021-36667)

Proofpoint Insider Threat Management Server is a server-side application from Proofpoint, Inc. for preventing malicious operations by enterprise insiders. A remote code execution vulnerability exists in the WriteWindowMouseWithChunksV2 API in Proofpoint Insider Threat Management Server versions...

Proofpoint Insider Threat Management Server Remote Code Execution Vulnerability (CNVD-2021-36666)

Proofpoint Insider Threat Management Server is a server-side application from Proofpoint, Inc. for preventing malicious operations by enterprise insiders. A remote code execution vulnerability exists in the ImportAlertRules feature of the ITM Web Console in Proofpoint Insider Threat Management...

Proofpoint Enterprise Protection Security Bypass Vulnerability

Proofpoint Enterprise Protection is a functional application from Proofpoint USA that provides email protection. A security bypass vulnerability exists in Proofpoint Enterprise Protection versions prior to 8.16.4, which can be exploited by an attacker to send an e-mail with a malicious attachment...

CVE-2020-14009

Proofpoint Enterprise Protection PPS/PoD before 8.16.4 contains a vulnerability that could allow an attacker to deliver an email message with a malicious attachment that bypasses scanning and file-blocking rules. The vulnerability exists because messages with certain crafted and malformed multipa...

CVE-2020-14009

Proofpoint Enterprise Protection PPS/PoD before 8.16.4 contains a vulnerability that could allow an attacker to deliver an email message with a malicious attachment that bypasses scanning and file-blocking rules. The vulnerability exists because messages with certain crafted and malformed multipa...

Design/Logic Flaw

Proofpoint Enterprise Protection PPS/PoD before 8.16.4 contains a vulnerability that could allow an attacker to deliver an email message with a malicious attachment that bypasses scanning and file-blocking rules. The vulnerability exists because messages with certain crafted and malformed multipa...

CVE-2020-14009

Affected product: Proofpoint Enterprise Protection (PPS/PoD) prior to version 8.16.4. Root cause: Messages with crafted/malformed multipart structures are not properly handled, enabling bypass of scanning and file-blocking rules. Impact: An attacker could deliver an email with a malicious attachm...

CVE-2020-14009

Proofpoint Enterprise Protection PPS/PoD before 8.16.4 contains a vulnerability that could allow an attacker to deliver an email message with a malicious attachment that bypasses scanning and file-blocking rules. The vulnerability exists because messages with certain crafted and malformed multipa...

CVE-2020-14009: Improper Validation of Integrity Check Value

Proofpoint Enterprise Protection PPS/PoD before 8.16.4 contains a vulnerability that could allow an attacker to deliver an email message with a malicious attachment that bypasses scanning and file-blocking rules. The vulnerability exists because messages with certain crafted and malformed multipa...

PT-2021-9685

Name of the Vulnerable Software and Affected Versions Proofpoint Enterprise Protection PPS/PoD versions prior to 8.16.4 Description The issue allows an attacker to deliver an email message with a malicious attachment that bypasses scanning and file-blocking rules. This is due to the improper...

Proofpoint Enterprise Protection security vulnerabilities

Proofpoint Enterprise Protection is a functional application from Proofpoint USA that provides email protection. A security bypass vulnerability exists in Proofpoint Enterprise Protection versions prior to 8.16.4, which can be exploited by an attacker to send an e-mail with a malicious attachment...

Buer Malware Tool Rewritten in E-Z Rust Language

A variant of the Buer malware, which is being distributed in emails disguised as DHL support shipping notices, comes with a fresh code rewrite in the popular Rust language and looks like it may be in the process of prepping for rental to other cybercrooks. Join Threatpost for “Fortifying Your...

Attention! FluBot Android Banking Malware Spreads Quickly Across Europe

Attention, Android users! A banking malware capable of stealing sensitive information is "spreading rapidly" across Europe, with the U.S. likely to be the next target. According to a new analysis by Proofpoint, the threat actors behind FluBot aka Cabassous have branched out beyond Spain to target...

Proofpoint Insider Threat Management Server Cross-Site Scripting Vulnerability

Proofpoint Insider Threat Management Server is a server-side application from Proofpoint, Inc. for preventing malicious operations by enterprise insiders. A cross-site scripting vulnerability exists in Proofpoint Insider Threat Management Server versions prior to 7.11.1, which allows for the...