Proofpoint Insider Threat Management Server
10 CVEs affecting Proofpoint Insider Threat Management Server. Latest disclosed: 2025-11-03. Critical: 4, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-40842 | Critical | 9.8 | 2021-10-13 | Proofpoint Insider Threat Management Server contains a SQL injection vulnerability in the Web Console. The vulnerability exists due to improper input validatio… |
CVE-2020-10658 | Critical | 9.8 | 2021-01-06 | The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteImage AP… |
CVE-2020-10656 | Critical | 9.8 | 2021-01-06 | The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMo… |
CVE-2020-10655 | Critical | 9.8 | 2021-01-06 | The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMo… |
CVE-2021-40843 | High | 7.3 | 2021-10-13 | Proofpoint Insider Threat Management Server contains an unsafe deserialization vulnerability in the Web Console. An attacker with write access to the local dat… |
CVE-2020-10657 | High | 7.2 | 2021-01-06 | The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM web console's ImportAlertRules fea… |
CVE-2023-36000 | Medium | 6.5 | 2023-06-27 | A missing authorization check in the MacOS agent configuration endpoint of the Insider Threat Management Server enables an anonymous attacker on an adjacent ne… |
CVE-2025-8558 | Medium | 5.4 | 2025-11-03 | Insider Threat Management (ITM) Server versions prior to 7.17.2 contain an authentication bypass vulnerability that allows unauthenticated users on an adjacent… |
CVE-2023-35998 | Medium | 4.6 | 2023-06-27 | A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on an adjacent network to read and write u… |
CVE-2023-36002 | Medium | 4.3 | 2023-06-27 | A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network… |