The vulnerabilities of Microsoft Lync Server and Skype for Business Server allow attackers to inject arbitrary web or HTML code.

The vulnerability of the jQuery server messaging components in Microsoft Lync Server and Skype for Business Server exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary web or HTML code through a special...

Microsoft Lync Server / Skype for Business crossite scripting

Multiple crossite scripting possibilities...

Microsoft Lync Server Cross-Site Scripting Vulnerability (CNVD-2015-05942)

Microsoft Lync is the next generation of integrated enterprise communication platform. Microsoft Lync Server 2013 and Skype for Business Server 2015, a cross-site scripting vulnerability exists in the jQuery engine, which can be exploited by remote attackers to inject arbitrary web script or HTML...

Microsoft Lync Server Cross-Site Scripting Vulnerability (CNVD-2015-05941)

Microsoft Lync is the next generation of integrated enterprise communication platform. A cross-site scripting vulnerability exists in Microsoft Lync Server 2013, which can be exploited by remote attackers to inject arbitrary web script or HTML via a constructed URL...

Microsoft Lync Server/Skype for Business Server Cross-Site Scripting Vulnerability

Microsoft Lync is the next generation of integrated enterprise communication platform. A cross-site scripting vulnerability exists in Microsoft Lync Server 2013 and Skype for Business Server 2015, which can be exploited by remote attackers to inject arbitrary web script or HTML via a constructed...

CVE-2015-2536

Cross-site scripting XSS vulnerability in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype for Business Server and Lync Server XSS Elevation of Privilege Vulnerability."...

CVE-2015-2531

Cross-site scripting XSS vulnerability in the jQuery engine in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype for Business Server and Lync Server XSS Information Disclosure Vulnerability."...

Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype for Business Server and Lync Server XSS Elevation of Privilege Vulnerability."...

Design/Logic Flaw

Cross-site scripting XSS vulnerability in the jQuery engine in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype for Business Server and Lync Server XSS Information Disclosure Vulnerability."...

Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Lync Server XSS Information Disclosure Vulnerability."...

CVE-2015-2532

Cross-site scripting XSS vulnerability in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Lync Server XSS Information Disclosure Vulnerability."...

CVE-2015-2532

Microsoft Lync Server 2013 contains a cross-site scripting vulnerability (CVE-2015-2532) triggered by a crafted URL, due to improper sanitization (jQuery-based context cited). It permits remote attackers to run arbitrary web script in a user’s browser, as described in the CVE record and corrobora...

Microsoft Lync Server Multiple Vulnerabilities (3089952)

This host is missing an important security update according to Microsoft Bulletin MS15-104. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2015-2531

CVE-2015-2531 is an XSS vulnerability in the jQuery engine used by Microsoft Lync Server 2013 and Skype for Business Server 2015. The issue allows an unauthenticated, remote attacker to inject arbitrary web script or HTML via a crafted URL, potentially exposing session information and enabling sc...

PT-2015-2004

Name of the Vulnerable Software and Affected Versions Microsoft Lync Server 2013 Skype for Business Server 2015 Description The issue exists due to insufficient protection of the web page structure in the jQuery component of Microsoft Lync Server and Skype for Business Server. This allows a remot...

MS15-104: Vulnerabilities in Skype for Business Server and Lync Server Could Allow Elevation of Privilege (3089952)

The remote Windows host is missing a security update. It is, therefore, affected by multiple cross-site scripting vulnerabilities in Skype for Business Server and Lync Server : - A cross-site scripting vulnerability exists in Skype for Business Server and Lync Server due to a failure by the jQuer...

CVE-2015-2531: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the jQuery engine in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype for Business Server and Lync Server XSS Information Disclosure Vulnerability."...

CVE-2015-2532: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Lync Server XSS Information Disclosure Vulnerability."...

PT-2015-2003

Name of the Vulnerable Software and Affected Versions Microsoft Lync Server 2013 Description The issue is related to a cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via a crafted URL. This is due to the lack of protection measures for t...

CVE-2015-2536

The CVE-2015-2536 issue is an XSS vulnerability in Microsoft Lync Server 2013 and Skype for Business Server 2015. The root cause is improper sanitization of input (notably via crafted URLs in the web context), enabling remote attackers to execute arbitrary script or HTML in a logged-in user’s bro...