Unscored severity · published Jun 12, 2012
CVE-2012-1849
Untrusted search path vulnerability in Microsoft Lync 2010, 2010 Attendee, and 2010 Attendant allows local users to gain privileges via a Trojan horse DLL in the current working…
–
CVSS
18.4%
EPSS
No
On KEV
Description
Untrusted search path vulnerability in Microsoft Lync 2010, 2010 Attendee, and 2010 Attendant allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .ocsmeet file, aka "Lync Insecure Library Loading Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)18.4% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LY
Lync · Microsoft
2010; 2010; 2010; 2010; 2010 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-1849
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-1849
US Government Resource
http://www.us-cert.gov/cas/techalerts/TA12-164A.html
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039
oval.cisecurity.org
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14874
More from Lync
7.8
CVE-2015-1671
Microsoft Windows Remote Code Execution Vulnerability
7.8
CVE-2013-3906
Microsoft Graphics Component Memory Corruption Vulnerability
9.8
CVE-2020-1025
An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation
9.8
CVE-2016-7182
The Graphics component in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10…
8.8
CVE-2018-8311
A remote code execution vulnerability exists when Skype for Business and Microsoft Lync clients fail to properly sanitize specially crafted content, aka "Remote Code Execution…