ISO 27001 Certificate
SOC 1 Type I Certificate
SOC 2 Type II Certificate
PCI DSS
HIPAA
RGPD
Internal validation & live display
Multiple badges & continuous verification
Faster underwriting decisions
ISOSOC2 Type 1SOC2 Type 2PCI DSSHIPAAGDPR

A better internet starts with privacy. At Proton, we believe that privacy is a human right, the foundation of a free and open society. That’s why we’re building an ecosystem of privacy-first, open-source tools that put people (not profits) first. Created by scientists from CERN and MIT, governed by the Proton Foundation (a Swiss non-profit organization) and powered by a global community of supporters, Proton is independent, community-funded, and 100% subscription-based, not driven by ads or data mining. Our privacy-by-design ecosystem includes: ✉️ Proton Mail: the world’s most private email service, free of ads and trackers 🌐 Proton VPN: a fast, secure VPN to browse freely and protect your identity online 🗓️ Proton Calendar: an encrypted calendar that keeps your schedule private 🗂️ Proton Drive: encrypted cloud storage with secure file sharing and Proton Docs for private document editing 🔑 Proton Pass: a secure password manager with a built in 2FA authenticator for logins, hide-my-email aliases, credit cards, notes, and encrypted files. 🔒 Proton Authenticator: a free, open-source 2FA app that keeps your accounts safe 🤖 Lumo: your privacy-respecting AI assistant, powered by Proton’s secure ecosystem Trusted by over 100 million people worldwide, from journalists and activists to global NGOs, academics, and creatives, Proton is the trusted alternative to Big Tech. Headquartered in Switzerland, with offices in Geneva, Zurich, Skopje, Taipei, Vilnius, Barcelona, Paris, and Prague, Proton is home to a growing team of 600+ people across 20+ countries, united by a single mission: To make privacy the default for everyone. 🔐

Proton A.I CyberSecurity Scoring

Proton

Company Details

Linkedin ID:

protonprivacy

Employees number:

798

Number of followers:

128,128

NAICS:

513

Industry Type:

Technology, Information and Internet

Homepage:

proton.me

IP Addresses:

319

Company ID:

PRO_2905041

Scan Status:

Completed

AI scoreProton Risk Score (AI oriented)

Between 700 and 749

https://images.rankiteo.com/companyimages/protonprivacy.jpeg
Proton Technology, Information and Internet
Updated:
  • Powered by our proprietary A.I cyber incident model
  • Insurance preferes TPRM score to calculate premium
globalscoreProton Global Score (TPRM)

XXXX

https://images.rankiteo.com/companyimages/protonprivacy.jpeg
Proton Technology, Information and Internet
  • Instant access to detailed risk factors
  • Benchmark vs. industry & size peers
  • Vulnerabilities
  • Findings

Proton Company CyberSecurity News & History

Past Incidents
3
Attack Types
2
EntityTypeSeverityImpactSeenBlog DetailsIncident DetailsView
ProtonBreach2517/2024
Rankiteo Explanation :
Attack without any consequences

Description: Proton is enhancing user privacy by launching an encrypted document creation and collaboration feature within its file storage system. This initiative counteracts the non-encrypted, data-intensive models of cloud services provided by companies like Google and Microsoft. Proton's encryption ensures that only document creators and permitted collaborators have access to file contents, barring even the company itself from viewing these private documents. The update positions Proton among the few businesses offering online encrypted document editing and reaffirms its commitment to user privacy and secure online experiences. The implementation mimics the user-friendliness of Google Docs, aiming to draw users who prioritize privacy without compromising on convenience.

ProtonVulnerability2517/2024
Rankiteo Explanation :
Attack without any consequences

Description: Proton, known for its privacy-centric services, has introduced a feature for creating, editing, and collaborating on end-to-end encrypted documents within its storage systems, challenging the practices of tech giants like Google and Microsoft. This innovation safeguards user data from third parties, including Proton, which cannot access the content of the files. The initiative enhances user privacy, directly confronting the data collection methodologies prevalent among leading cloud service providers. As a result, there have been no reported data leaks or negative consequences following the implementation of the encrypted document feature provided by Proton.

ProtonVulnerability6036/2018
Rankiteo Explanation :
Attack with significant impact with internal employee data leaks

Description: ProtonVPN were exposed to vulnerabilities that could have allowed hackers to execute arbitrary code with administrator privileges on computers running Windows. The bugs, CVE-2018-395 were discovered by Cisco Talos security researchers which is similar to another security flaw discovered in March by security consulting firm VerSprite. ProtonVPN had released patches to fix the original vulnerability. It was still possible to execute code as an administrator albeit through a exploit. The initial vulnerability was due to OpenVPN being able to select a malicious file when choosing a VPN configuration. This could have given access to private information and hacking through arbitrary commands. They use OpenVPN's open-source software to set up secure connections from one point to another. Later versions of ProtonVPN have resolved this issue and users have been automatically prompted to update. They have not seen any evidence of this being exploited in the wild, as a user's computer needs to first be compromised by a hacker before this bug can be exploited

Proton
Breach
Severity: 25
Impact: 1
Seen: 7/2024
Blog:
Rankiteo Explanation
Attack without any consequences

Description: Proton is enhancing user privacy by launching an encrypted document creation and collaboration feature within its file storage system. This initiative counteracts the non-encrypted, data-intensive models of cloud services provided by companies like Google and Microsoft. Proton's encryption ensures that only document creators and permitted collaborators have access to file contents, barring even the company itself from viewing these private documents. The update positions Proton among the few businesses offering online encrypted document editing and reaffirms its commitment to user privacy and secure online experiences. The implementation mimics the user-friendliness of Google Docs, aiming to draw users who prioritize privacy without compromising on convenience.

Proton
Vulnerability
Severity: 25
Impact: 1
Seen: 7/2024
Blog:
Rankiteo Explanation
Attack without any consequences

Description: Proton, known for its privacy-centric services, has introduced a feature for creating, editing, and collaborating on end-to-end encrypted documents within its storage systems, challenging the practices of tech giants like Google and Microsoft. This innovation safeguards user data from third parties, including Proton, which cannot access the content of the files. The initiative enhances user privacy, directly confronting the data collection methodologies prevalent among leading cloud service providers. As a result, there have been no reported data leaks or negative consequences following the implementation of the encrypted document feature provided by Proton.

Proton
Vulnerability
Severity: 60
Impact: 3
Seen: 6/2018
Blog:
Rankiteo Explanation
Attack with significant impact with internal employee data leaks

Description: ProtonVPN were exposed to vulnerabilities that could have allowed hackers to execute arbitrary code with administrator privileges on computers running Windows. The bugs, CVE-2018-395 were discovered by Cisco Talos security researchers which is similar to another security flaw discovered in March by security consulting firm VerSprite. ProtonVPN had released patches to fix the original vulnerability. It was still possible to execute code as an administrator albeit through a exploit. The initial vulnerability was due to OpenVPN being able to select a malicious file when choosing a VPN configuration. This could have given access to private information and hacking through arbitrary commands. They use OpenVPN's open-source software to set up secure connections from one point to another. Later versions of ProtonVPN have resolved this issue and users have been automatically prompted to update. They have not seen any evidence of this being exploited in the wild, as a user's computer needs to first be compromised by a hacker before this bug can be exploited

Ailogo

Proton Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

🔒
Incident Predictions locked
Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

🔒
A.I. Risk Score Predictions locked
Access Monitoring Plan
statics

Underwriter Stats for Proton

Incidents vs Technology, Information and Internet Industry Average (This Year)

No incidents recorded for Proton in 2025.

Incidents vs All-Companies Average (This Year)

No incidents recorded for Proton in 2025.

Incident Types Proton vs Technology, Information and Internet Industry Avg (This Year)

No incidents recorded for Proton in 2025.

Incident History — Proton (X = Date, Y = Severity)

Proton cyber incidents detection timeline including parent company and subsidiaries

Proton Company Subsidiaries

SubsidiaryImage

A better internet starts with privacy. At Proton, we believe that privacy is a human right, the foundation of a free and open society. That’s why we’re building an ecosystem of privacy-first, open-source tools that put people (not profits) first. Created by scientists from CERN and MIT, governed by the Proton Foundation (a Swiss non-profit organization) and powered by a global community of supporters, Proton is independent, community-funded, and 100% subscription-based, not driven by ads or data mining. Our privacy-by-design ecosystem includes: ✉️ Proton Mail: the world’s most private email service, free of ads and trackers 🌐 Proton VPN: a fast, secure VPN to browse freely and protect your identity online 🗓️ Proton Calendar: an encrypted calendar that keeps your schedule private 🗂️ Proton Drive: encrypted cloud storage with secure file sharing and Proton Docs for private document editing 🔑 Proton Pass: a secure password manager with a built in 2FA authenticator for logins, hide-my-email aliases, credit cards, notes, and encrypted files. 🔒 Proton Authenticator: a free, open-source 2FA app that keeps your accounts safe 🤖 Lumo: your privacy-respecting AI assistant, powered by Proton’s secure ecosystem Trusted by over 100 million people worldwide, from journalists and activists to global NGOs, academics, and creatives, Proton is the trusted alternative to Big Tech. Headquartered in Switzerland, with offices in Geneva, Zurich, Skopje, Taipei, Vilnius, Barcelona, Paris, and Prague, Proton is home to a growing team of 600+ people across 20+ countries, united by a single mission: To make privacy the default for everyone. 🔐

Loading...
similarCompanies

Proton Similar Companies

Avnet

Avnet is a global electronic components distributor with extensive design, product, marketing and supply chain expertise for customers and suppliers at every stage of the product lifecycle. For the past 100 years, Avnet has helped its customers and suppliers around the world realize the transformati

Jumia Group

Jumia (NYSE :JMIA) is a leading e-commerce platform in Africa. It is built around a marketplace, Jumia Logistics, and JumiaPay. The marketplace helps millions of consumers and sellers to connect and transact. Jumia Logistics enables the delivery of millions of packages through our network of local p

Times Internet

At Times Internet, we create premium digital products that simplify and enhance the lives of millions. As India’s largest digital products company, we have a significant presence across a wide range of categories, including News, Sports, Fintech, and Enterprise solutions. Our portfolio features mar

The Death Star

The mission of the Death Star is to keep the local systems "in line". As we have recently dissolved our Board of Directors, there is little resistance to our larger goal of universal domination. Our Stormtroopers are excellent shots and operate with our Navy, and are fielded like marines - sep

Meesho

Meesho is India’s fastest growing internet commerce company. We want to make eCommerce accessible to all. Our vision is to enable 100 million small businesses in India, including individual entrepreneurs, to succeed online. Our mission is to democratise internet commerce by bringing a range of produ

Mercado Livre Brasil

Fundada em 1999, MercadoLivre é uma companhia de tecnologia líder em comércio eletrônico na América Latina. Por meio de suas principais plataformas MercadoLivre.com e MercadoPago.com, oferece soluções de comércio eletrônico para que pessoas e empresas possam comprar, vender, pagar e anunciar produto

As a leading internet technology company based in China, NetEase, Inc. (NASDAQ: NTES and HKEX:9999, "NetEase") provides premium online services centered around content creation. With extensive offerings across its expanding gaming ecosystem, NetEase develops and operates some of China's most popula

Peraton

Do the can't be done. At Peraton, we're at the forefront of delivering the next big thing every day. We're the partner of choice to help solve some of the world's most daunting challenges, delivering bold, new solutions to keep people around the world safer and more secure. How do we do it? By thi

Myntra

At Myntra, we don’t just follow fashion - we define it. As India's leading fashion, lifestyle, and beauty destination, we bring together the best of style, technology, and innovation to create a seamless shopping experience for our customers. With a commitment to empowering self-expression, we cura

newsone

Proton CyberSecurity News

November 11, 2025 03:38 PM
In the wake of the Louvre heist, Proton steps in to offer free password protection

Cultural institutions can get two years of Proton's premium password manager for free.

November 06, 2025 08:00 AM
Proton VPN Uses Early Black Friday Revenue to Add 800 New Global Exit Nodes

Proton VPN reveals that early Black Friday sales funded the addition of 800 exit nodes, reinforcing its privacy-driven infrastructure model.

November 03, 2025 08:00 AM
Proton Exposes 300 Million Stolen Credentials Available for Sale on Dark Web Cybercrime Markets

Proton has launched a new initiative called the Data Breach Observatory. This program reveals serious problems that exist on the internet.

November 03, 2025 08:00 AM
Proton Uncovers 300 Million Stolen Credentials on the Dark Web

Privacy-focused tech company Proton has discovered a massive trove of compromised user data on the dark web, exposing growing cyber risks...

November 01, 2025 07:00 AM
New Proton Research Exposes 300 Million Stolen Credentials

Updated November 1 with further analysis of how leaked and stolen passwords are abused using genuine accounts in light of the Proton...

October 31, 2025 07:00 AM
Proton VPN Review 2025: In-depth Test Results

Read my Proton VPN review to discover its main pros and cons. Learn about its features, speed, security, and whether it's worth your...

October 30, 2025 01:59 PM
Proton Unveils Data Breach Observatory for Dark Web Credential Alerts

In the ever-evolving world of cybersecurity, Swiss privacy firm Proton has unveiled a new tool designed to give users an unprecedented edge...

October 30, 2025 07:00 AM
Proton launches 'Data Breach Observatory' to track personal info leaks

The living report plans to expose the market for stolen data by monitoring credential markets on the dark web.

October 15, 2025 07:00 AM
Dealer software firms boost cyber defenses after CDK hack shakes industry

A watershed cyberattack in 2024 that crippled thousands of dealerships in North America wasn't just a wake-up call for dealers,...

faq

Frequently Asked Questions

Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.

Proton CyberSecurity History Information

Official Website of Proton

The official website of Proton is https://proton.me/.

Proton’s AI-Generated Cybersecurity Score

According to Rankiteo, Proton’s AI-generated cybersecurity score is 719, reflecting their Moderate security posture.

How many security badges does Proton’ have ?

According to Rankiteo, Proton currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Does Proton have SOC 2 Type 1 certification ?

According to Rankiteo, Proton is not certified under SOC 2 Type 1.

Does Proton have SOC 2 Type 2 certification ?

According to Rankiteo, Proton does not hold a SOC 2 Type 2 certification.

Does Proton comply with GDPR ?

According to Rankiteo, Proton is not listed as GDPR compliant.

Does Proton have PCI DSS certification ?

According to Rankiteo, Proton does not currently maintain PCI DSS compliance.

Does Proton comply with HIPAA ?

According to Rankiteo, Proton is not compliant with HIPAA regulations.

Does Proton have ISO 27001 certification ?

According to Rankiteo,Proton is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Industry Classification of Proton

Proton operates primarily in the Technology, Information and Internet industry.

Number of Employees at Proton

Proton employs approximately 798 people worldwide.

Subsidiaries Owned by Proton

Proton presently has no subsidiaries across any sectors.

Proton’s LinkedIn Followers

Proton’s official LinkedIn profile has approximately 128,128 followers.

NAICS Classification of Proton

Proton is classified under the NAICS code 513, which corresponds to Others.

Proton’s Presence on Crunchbase

No, Proton does not have a profile on Crunchbase.

Proton’s Presence on LinkedIn

Yes, Proton maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/protonprivacy.

Cybersecurity Incidents Involving Proton

As of November 28, 2025, Rankiteo reports that Proton has experienced 3 cybersecurity incidents.

Number of Peer and Competitor Companies

Proton has an estimated 12,525 peer or competitor companies worldwide.

What types of cybersecurity incidents have occurred at Proton ?

Incident Types: The types of cybersecurity incidents that have occurred include Breach and Vulnerability.

How does Proton detect and respond to cybersecurity incidents ?

Detection and Response: The company detects and responds to cybersecurity incidents through an third party assistance with cisco talos, third party assistance with versprite, and remediation measures with released patches to fix the vulnerability, remediation measures with automatically prompted users to update..

Incident Details

Can you provide details on each incident ?

Incident : Vulnerability Exploitation

Title: ProtonVPN Vulnerability Exposure

Description: ProtonVPN was exposed to vulnerabilities that could have allowed hackers to execute arbitrary code with administrator privileges on computers running Windows.

Type: Vulnerability Exploitation

Attack Vector: Selecting a malicious file when choosing a VPN configuration

Vulnerability Exploited: CVE-2018-3952

Motivation: Unauthorized access to private information and arbitrary command execution

Incident : Feature Enhancement

Title: Proton Enhances User Privacy with Encrypted Document Feature

Description: Proton is launching an encrypted document creation and collaboration feature within its file storage system to enhance user privacy and security.

Type: Feature Enhancement

Motivation: Enhance user privacy and security

Incident : Feature Implementation

Title: Proton Introduces End-to-End Encrypted Documents

Description: Proton has introduced a feature for creating, editing, and collaborating on end-to-end encrypted documents within its storage systems, challenging the practices of tech giants like Google and Microsoft. This innovation safeguards user data from third parties, including Proton, which cannot access the content of the files. The initiative enhances user privacy, directly confronting the data collection methodologies prevalent among leading cloud service providers. As a result, there have been no reported data leaks or negative consequences following the implementation of the encrypted document feature provided by Proton.

Type: Feature Implementation

Motivation: Enhance user privacy

What are the most common types of attacks the company has faced ?

Common Attack Types: The most common types of attacks the company has faced is Vulnerability.

Impact of the Incidents

What was the impact of each incident ?

Incident : Vulnerability Exploitation PRO023301022

Systems Affected: Windows computers running ProtonVPN

Incident : Feature Enhancement PRO1010070724

Brand Reputation Impact: Positive

Which entities were affected by each incident ?

Incident : Vulnerability Exploitation PRO023301022

Entity Name: ProtonVPN

Entity Type: Company

Industry: Cybersecurity

Incident : Feature Enhancement PRO1010070724

Entity Name: Proton

Entity Type: Company

Industry: Technology

Incident : Feature Implementation PRO000070924

Entity Name: Proton

Entity Type: Company

Industry: Technology

Response to the Incidents

What measures were taken in response to each incident ?

Incident : Vulnerability Exploitation PRO023301022

Third Party Assistance: Cisco Talos, Versprite.

Remediation Measures: Released patches to fix the vulnerabilityAutomatically prompted users to update

How does the company involve third-party assistance in incident response ?

Third-Party Assistance: The company involves third-party assistance in incident response through Cisco Talos, VerSprite, .

Data Breach Information

What type of data was compromised in each breach ?

Incident : Feature Enhancement PRO1010070724

Data Encryption: Yes

Incident : Feature Implementation PRO000070924

Data Encryption: End-to-end encryption

What measures does the company take to prevent data exfiltration ?

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Released patches to fix the vulnerability, Automatically prompted users to update, .

Lessons Learned and Recommendations

What lessons were learned from each incident ?

Incident : Feature Implementation PRO000070924

Lessons Learned: Implementing end-to-end encryption for documents enhances user privacy and safeguards data from third parties.

What recommendations were made to prevent future incidents ?

Incident : Feature Implementation PRO000070924

Recommendations: Consider adopting similar end-to-end encryption measures for data protection.

What are the key lessons learned from past incidents ?

Key Lessons Learned: The key lessons learned from past incidents are Implementing end-to-end encryption for documents enhances user privacy and safeguards data from third parties.

References

Where can I find more information about each incident ?

Incident : Vulnerability Exploitation PRO023301022

Source: Cisco Talos

Incident : Vulnerability Exploitation PRO023301022

Source: VerSprite

Where can stakeholders find additional resources on cybersecurity best practices ?

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Cisco Talos, and Source: VerSprite.

Post-Incident Analysis

What were the root causes and corrective actions taken for each incident ?

Incident : Vulnerability Exploitation PRO023301022

Root Causes: Openvpn Being Able To Select A Malicious File When Choosing A Vpn Configuration,

Corrective Actions: Released Patches To Fix The Vulnerability, Automatically Prompted Users To Update,

What is the company's process for conducting post-incident analysis ?

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Cisco Talos, Versprite, .

What corrective actions has the company taken based on post-incident analysis ?

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Released Patches To Fix The Vulnerability, Automatically Prompted Users To Update, .

Additional Questions

Impact of the Incidents

What was the most significant system affected in an incident ?

Most Significant System Affected: The most significant system affected in an incident was Windows computers running ProtonVPN.

Response to the Incidents

What third-party assistance was involved in the most recent incident ?

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was cisco talos, versprite, .

Lessons Learned and Recommendations

What was the most significant lesson learned from past incidents ?

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Implementing end-to-end encryption for documents enhances user privacy and safeguards data from third parties.

What was the most significant recommendation implemented to improve cybersecurity ?

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Consider adopting similar end-to-end encryption measures for data protection..

References

What is the most recent source of information about an incident ?

Most Recent Source: The most recent source of information about an incident are Cisco Talos and VerSprite.

cve

Latest Global CVEs (Not Company-Specific)

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.

Risk Information
cvss4
Base: 7.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.

Risk Information
cvss4
Base: 8.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.

Risk Information
cvss4
Base: 6.3
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected when working with large buffers. This includes a rule passing a large buffer to a Lua script. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling Lua rules and output scripts, or making sure limits, such as stream.depth.reassembly and HTTP response body limits (response-body-limit), are set to less than half the stack size.

Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is used in conjunction with base64_data. This issue has been patched in version 8.0.2. A workaround involves disabling rules that use entropy in conjunction with base64_data.

Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Access Data Using Our API

SubsidiaryImage

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=protonprivacy' -H 'apikey: YOUR_API_KEY_HERE'

What Do We Measure ?

revertimgrevertimgrevertimgrevertimg
Incident
revertimgrevertimgrevertimgrevertimg
Finding
revertimgrevertimgrevertimgrevertimg
Grade
revertimgrevertimgrevertimgrevertimg
Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network Security

Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)

Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)

Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat Intelligence

Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Top LeftTop RightBottom LeftBottom Right
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
Users Love Us Badge