Skype for Business Elevation of Privilege Vulnerability

Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.

Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 2010 SP2,Office Web Apps 2013 SP1, Project Server 2013 SP1, SharePoint Enterprise Server 2013 SP1, SharePoint Enterprise Server 2016, SharePoint Foundation 2013 SP1, Sharepoint Server 2010 SP2, Word 2016, and Skype for Business 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0261 and CVE-2017-0262.

Skype for Business Elevation of Privilege Vulnerability

Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.

Skype for Business Remote Code Execution Vulnerability

Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.

Skype for Business Spoofing Vulnerability

Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network.

Skype for Business Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.

Skype for Business and Lync Denial of Service Vulnerability

Out-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network.

Skype for Business and Lync Denial of Service Vulnerability

Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network.

Skype for Business Information Disclosure Vulnerability

Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network.

Skype for Business Spoofing Vulnerability

Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.

Skype for Business Information Disclosure Vulnerability

Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network.

Skype for Business and Lync Denial of Service Vulnerability

Null pointer dereference in Skype for Business allows an authorized attacker to deny service over a network.

Skype for Business Remote Code Execution Vulnerability

External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.

Skype for Business Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.

Skype for Business Information Disclosure Vulnerability

Skype for Business Information Disclosure Vulnerability

Microsoft Office Remote Code Execution Vulnerability

Microsoft Office Remote Code Execution Vulnerability

Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.6.0.244, and earlier 3.5.x and 3.6.x versions, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Title field of a (1) Dailymotion and possibly (2) Metacafe movie in the Skype video gallery, accessible through a search within the "Add video to chat" dialog, aka "videomood XSS."

Argument injection vulnerability in the URI handler in Skype 2.0.*.104 and 2.5.*.0 through 2.5.*.78 for Windows allows remote authorized attackers to download arbitrary files via a URL that contains certain command-line switches.

Microsoft Office Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation. An attacker who successfully exploited the vulnerability could bypass authentication and achieve improper access. To exploit this vulnerability, an attacker would need to modify the token. The update addresses the vulnerability by modifying how Microsoft SharePoint Server and Skype for Business Server validate tokens.

Skype Extension for Chrome Information Disclosure Vulnerability

Skype Extension for Chrome Information Disclosure Vulnerability