Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
84 results · page 1 of 2
Oct 13, 2026Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.CVE-2026-85873 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.
- Product
- Skype for Business Server 2015 CU13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.CVE-2026-83746 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.
- Product
- Skype for Business Server 2015 CU13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.CVE-2026-70297 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.
- Product
- Skype for Business Server 2015 CU13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network.CVE-2026-69646 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.3
Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network.
- Product
- Skype for Business Server 2015 CU13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing oCVE-2026-69642 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.
- Product
- Skype for Business Server 2015 CU13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Out-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network.CVE-2026-66308 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Out-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network.
- Product
- Skype for Business Server 2015 CU13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network.CVE-2026-66307 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network.
- Product
- Skype for Business Server 2015 CU13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network.CVE-2026-66306 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network.
- Product
- Skype for Business Server 2015 CU13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.CVE-2026-66305 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.
- Product
- Skype for Business Server 2015 CU13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network.CVE-2026-66304 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network.
- Product
- Skype for Business Server 2015 CU13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Null pointer dereference in Skype for Business allows an authorized attacker to deny service over a network.CVE-2026-66303 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Null pointer dereference in Skype for Business allows an authorized attacker to deny service over a network.
- Product
- Skype for Business Server 2015 CU13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.CVE-2026-66302 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.
- Product
- Skype for Business Server 2015 CU13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing oCVE-2026-63523 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.
- Product
- Skype for Business Server 2015 CU13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2025Ultra Skype Button: Stored Cross-Site ScriptingCVE-2025-13898 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultra Skype Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_id' parameter of the [ultra_skype] shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Ultra Skype Button
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Ultra Skype Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2025A path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions <= 1.0.4.80 in its embedded web server.CVE-2013-10063 · Network & remote access · Netgear · reported by VulnCheckMedium 6.9
A path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions <= 1.0.4.80 in its embedded web server. Authenticated attackers can exploit crafted GET requests to access arbitrary files outside the web root by injecting traversal sequences. This can expose sensitive system files and configuration data.
- Product
- SPH200D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comweb.archive.org
May 2, 2024Wow Skype Buttons: Does not have CSRF checks in some bulk actionsCVE-2024-3474 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Wow Skype Buttons WordPress plugin before 4.0.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks
- Product
- Wow Skype Buttons
- Fixed in
- 4.0.4
- What to do
- Update Wow Skype Buttons to 4.0.4 or newer.
Mar 12, 2024Skype for Consumer Remote Code Execution VulnerabilityCVE-2024-21411 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Skype for Consumer Remote Code Execution Vulnerability
- Product
- Skype for Consumer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 13, 2024Skype for Business Information Disclosure VulnerabilityCVE-2024-20695 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.7
Skype for Business Information Disclosure Vulnerability
- Product
- Skype for Business Server 2019 CU7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Oct 20, 2023Skype Legacy Buttons: Stored Cross-Site ScriptingCVE-2023-5615 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Skype Legacy Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skype-status' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Skype Legacy Buttons
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Skype Legacy Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 10, 2023Microsoft Skype for Business Privilege Escalation VulnerabilityCVE-2023-41763 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.3
Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation.
- Product
- Skype for Business
- On CISA’s list since
- Oct 10, 2023 (federal fix deadline Oct 31, 2023)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.commsrc.microsoft.com
Oct 10, 2023Skype for Business Remote Code Execution VulnerabilityCVE-2023-36789 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Skype for Business Remote Code Execution Vulnerability
- Product
- Skype for Business Server 2019 CU7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Oct 10, 2023Skype for Business Remote Code Execution VulnerabilityCVE-2023-36786 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Skype for Business Remote Code Execution Vulnerability
- Product
- Skype for Business Server 2015 CU13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Oct 10, 2023Skype for Business Remote Code Execution VulnerabilityCVE-2023-36780 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Skype for Business Remote Code Execution Vulnerability
- Product
- Skype for Business Server 2019 CU7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
May 9, 2023Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skype and linedin_url parameters.CVE-2023-31802 · Other software · Chamilo · reported by MITREMedium 5.4
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skype and linedin_url parameters.
- Product
- Chamilo LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.chamilo.orgsupport.chamilo.org
Jul 12, 2022Skype for Business and Lync Remote Code Execution VulnerabilityCVE-2022-33633 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Skype for Business and Lync Remote Code Execution Vulnerability
- Product
- Microsoft Lync Server 2013 CU10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 30, 2022Jenkins Skype notifier Plugin 1.1.0 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed CVE-2022-34805 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Skype notifier Plugin 1.1.0 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
- Product
- Jenkins Skype notifier Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022Skype for Business Information Disclosure VulnerabilityCVE-2022-26911 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Skype for Business Information Disclosure Vulnerability
- Product
- Microsoft Lync Server 2013 CU10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Skype for Business and Lync Spoofing VulnerabilityCVE-2022-26910 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.3
Skype for Business and Lync Spoofing Vulnerability
- Product
- Skype for Business Server 2015 CU12
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 9, 2022Skype Extension for Chrome Information Disclosure VulnerabilityCVE-2022-24522 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Skype Extension for Chrome Information Disclosure Vulnerability
- Product
- Skype Extension for Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
May 11, 2021Skype for Business and Lync Remote Code Execution VulnerabilityCVE-2021-26422 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Skype for Business and Lync Remote Code Execution Vulnerability
- Product
- Microsoft Lync Server 2013 CU10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
May 11, 2021Skype for Business and Lync Spoofing VulnerabilityCVE-2021-26421 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Skype for Business and Lync Spoofing Vulnerability
- Product
- Skype for Business Server 2015 CU11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Feb 25, 2021Skype for Business and Lync Denial of Service VulnerabilityCVE-2021-24099 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Skype for Business and Lync Denial of Service Vulnerability
- Product
- Skype for Business Server 2019 CU2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Feb 25, 2021Skype for Business and Lync Spoofing VulnerabilityCVE-2021-24073 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Skype for Business and Lync Spoofing Vulnerability
- Product
- Skype for Business Server 2015 CU 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jan 11, 2021Microsoft Skype through 8.59.0.77 on macOS has the disable-library-validation entitlement, which allows a local process (with the user's privileges) to obtain uCVE-2020-24003 · Computers, phones & browsers · Microsoft · reported by MITRELow 3.3
Microsoft Skype through 8.59.0.77 on macOS has the disable-library-validation entitlement, which allows a local process (with the user's privileges) to obtain unprompted microphone and camera access by loading a crafted library and thereby inheriting Skype Client's microphone and camera access.
- Product
- Skype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2020A Cross Site Scripting (XSS) vulnerability in Savsoft Quiz v5.0 allows remote attackers to inject arbitrary web script or HTML via the Skype ID field.CVE-2020-27515 · Other software · Techkshetrainfo · reported by MITREMedium 6.1
A Cross Site Scripting (XSS) vulnerability in Savsoft Quiz v5.0 allows remote attackers to inject arbitrary web script or HTML via the Skype ID field.
- Product
- Savsoft Quiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsavsoftquiz.com
Jul 14, 2020An information disclosure vulnerability exists when Skype for Business is accessed via Microsoft Edge (EdgeHTML-based), aka 'Skype for Business via Microsoft EdCVE-2020-1462 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
An information disclosure vulnerability exists when Skype for Business is accessed via Microsoft Edge (EdgeHTML-based), aka 'Skype for Business via Microsoft Edge (EdgeHTML-based) Information Disclosure Vulnerability'.
- Product
- Microsoft Edge (EdgeHTML-based) on Windows 10 Version 2004 for ARM64-based Systems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2020An information disclosure vulnerability exists when Skype for Business is accessed via Internet Explorer, aka 'Skype for Business via Internet Explorer InformatCVE-2020-1432 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
An information disclosure vulnerability exists when Skype for Business is accessed via Internet Explorer, aka 'Skype for Business via Internet Explorer Information Disclosure Vulnerability'.
- Product
- Internet Explorer 11 on Windows 10 Version 2004 for x64-based Systems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2020An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation.CVE-2020-1025 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation. An attacker who successfully exploited the vulnerability could bypass authentication and achieve improper access. To exploit this vulnerability, an attacker would need to modify the token. The update addresses the vulnerability by modifying how Microsoft SharePoint Server and Skype for Business Server validate tokens.
- Product
- Skype for Business Server 2019 CU2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Dec 10, 2019A spoofing vulnerability exists when a Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business Server SpoofingCVE-2019-1490 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
A spoofing vulnerability exists when a Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business Server Spoofing Vulnerability'.
- Product
- Skype for Business Server 2019 CU2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jun 12, 2019A denial of service vulnerability exists in Skype for Business.CVE-2019-1029 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
A denial of service vulnerability exists in Skype for Business. An attacker who successfully exploited the vulnerability could cause Skype for Business to stop responding. Note that the denial of service would not allow an attacker to execute code or to elevate the attacker's user rights. To exploit the vulnerability, an attacker needs to obtain a dial-in link for a vulnerable server and then initiates a series of calls within a short amount of time. The update addresses the vulnerability by correcting the way that Skype for Business server handles objects in memory.
- Product
- Microsoft Lync Server 2010
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
May 16, 2019An information disclosure vulnerability exists in Skype for Android, aka 'Skype for Android Information Disclosure Vulnerability'.CVE-2019-0932 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
An information disclosure vulnerability exists in Skype for Android, aka 'Skype for Android Information Disclosure Vulnerability'.
- Product
- Skype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 8, 2019A spoofing vulnerability exists when a Lync Server or Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business CVE-2019-0798 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
A spoofing vulnerability exists when a Lync Server or Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business and Lync Spoofing Vulnerability'.
- Product
- Skype for Business Server 2015
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jan 17, 2019A spoofing vulnerability exists when a Skype for Business 2015 server does not properly sanitize a specially crafted request, aka "Skype for Business 2015 SpoofCVE-2019-0624 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
A spoofing vulnerability exists when a Skype for Business 2015 server does not properly sanitize a specially crafted request, aka "Skype for Business 2015 Spoofing Vulnerability." This affects Skype.
- Product
- Skype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comportal.msrc.microsoft.com
Jan 8, 2019An elevation of privilege vulnerability exists when Skype for Andriod fails to properly handle specific authentication requests, aka "Skype for Android ElevatioCVE-2019-0622 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.6
An elevation of privilege vulnerability exists when Skype for Andriod fails to properly handle specific authentication requests, aka "Skype for Android Elevation of Privilege Vulnerability." This affects Skype 8.35.
- Product
- Skype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comportal.msrc.microsoft.com
Nov 13, 2018A denial of service vulnerability exists in Skype for Business, aka "Microsoft Skype for Business Denial of Service Vulnerability." This affects Office 365 ProPCVE-2018-8546 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
A denial of service vulnerability exists in Skype for Business, aka "Microsoft Skype for Business Denial of Service Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Lync, Skype.
- Product
- Skype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jul 10, 2018A remote code execution vulnerability exists when Skype for Business and Microsoft Lync clients fail to properly sanitize specially crafted content, aka "RemoteCVE-2018-8311 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
A remote code execution vulnerability exists when Skype for Business and Microsoft Lync clients fail to properly sanitize specially crafted content, aka "Remote Code Execution Vulnerability in Skype For Business and Lync." This affects Skype, Microsoft Lync.
- Product
- Skype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jul 10, 2018A security feature bypass vulnerability exists when Skype for Business or Lync do not properly parse UNC path links shared via messages, aka "Skype for BusinessCVE-2018-8238 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
A security feature bypass vulnerability exists when Skype for Business or Lync do not properly parse UNC path links shared via messages, aka "Skype for Business and Lync Security Feature Bypass Vulnerability." This affects Skype, Microsoft Lync.
- Product
- Skype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comportal.msrc.microsoft.com
Jun 26, 2018Untrusted search path vulnerability in the installer of Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directoCVE-2018-0595 · Computers, phones & browsers · Microsoft · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in the installer of Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- The installer of Skype for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Jun 26, 2018Untrusted search path vulnerability in Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.CVE-2018-0594 · Computers, phones & browsers · Microsoft · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Skype for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Oct 13, 2017Skype for Business in Microsoft Lync 2013 SP1 and Skype for Business 2016 allows an attacker to steal an authentication hash that can be reused elsewhere, due tCVE-2017-11786 · Computers, phones & browsers · Microsoft Corporation · reported by secure@microsoft.comHigh 8.8
Skype for Business in Microsoft Lync 2013 SP1 and Skype for Business 2016 allows an attacker to steal an authentication hash that can be reused elsewhere, due to how Skype for Business handles authentication requests, aka "Skype for Business Elevation of Privilege Vulnerability."
- Product
- Skype for Business
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.