Login Request a demo
Unscored severity · published Nov 11, 2015
CVE-2015-6061
Cross-site scripting (XSS) vulnerability in Microsoft Skype for Business 2016, Lync 2010 and 2013 SP1, Lync 2010 Attendee, and Lync Room System allows remote attackers to inject…
–
CVSS
12.8%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Microsoft Skype for Business 2016, Lync 2010 and 2013 SP1, Lync 2010 Attendee, and Lync Room System allows remote attackers to inject arbitrary web script or HTML via an instant-message session, aka "Server Input Validation Information Disclosure Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)12.8% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LY
Lync · Microsoft
2010; 2010; 2010; 2013; 2013 · source: NVD
LR
Lync Room System · Microsoft
All versions, or not specified · source: NVD
SF
Skype For Business · Microsoft
2016 · source: NVD
Affected product
LY
Lync
Microsoft
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-6061
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-6061
www.securitytracker.com
http://www.securitytracker.com/id/1034126
www.securitytracker.com
http://www.securitytracker.com/id/1034127
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-123
More from Lync
7.8
CVE-2015-1671
Microsoft Windows Remote Code Execution Vulnerability
7.8
CVE-2013-3906
Microsoft Graphics Component Memory Corruption Vulnerability
9.8
CVE-2020-1025
An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation
9.8
CVE-2016-7182
The Graphics component in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10…
8.8
CVE-2018-8311
A remote code execution vulnerability exists when Skype for Business and Microsoft Lync clients fail to properly sanitize specially crafted content, aka "Remote Code Execution…