Cross site scripting

The toStaticHTML API aka the SafeHTML component in Microsoft Internet Explorer 8 and 9, Communicator 2007 R2, and Lync 2010 and 2010 Attendee does not properly handle event attributes and script, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via a crafted...

CVE-2012-1849

CVE-2012-1849 is an Untrusted search path DLL loading vulnerability in Microsoft Lync 2010 and related components (Attendee/Attendant). The root cause is loading of a Trojan horse DLL from the current working directory, demonstrated with a .ocsmeet file, enabling local privilege elevation. Affect...

CVE-2012-1849

Untrusted search path vulnerability in Microsoft Lync 2010, 2010 Attendee, and 2010 Attendant allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .ocsmeet file, aka "Lync Insecure Library Loading...

CVE-2012-1858

The toStaticHTML API aka the SafeHTML component in Microsoft Internet Explorer 8 and 9, Communicator 2007 R2, and Lync 2010 and 2010 Attendee does not properly handle event attributes and script, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via a crafted...

Microsoft Lync CVE-2012-1849 DLL Loading Arbitrary Code Execution Vulnerability

Description Microsoft Lync is prone to vulnerability that lets attackers execute arbitrary code. An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location which contains a specially crafted Dynamic Link Library...

Microsoft Internet Explorer And Microsoft Lync HTML Sanitizing Information Disclosure Vulnerability

Description Microsoft Internet Explorer and Microsoft Lync are prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in further attacks. Technologies Affected Microsoft Groove Server 2010 Microsoft Groove Server 2010 SP1...

MS12-039: Description of the security update for Lync 2010 Attendee (user level install): June 12, 2012

Resolves vulnerabilities in Microsoft Lync that could allow remote code execution if a user views shared content that contains specially crafted TrueType fonts.INTRODUCTIONMicrosoft has released security bulletin MS12-039. To view the complete security bulletin, go to one of the following Microso...

PT-2012-3601 · Microsoft · Lync +4

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer versions 8 through 9 Microsoft Communicator version 2007 R2 Microsoft Lync versions 2010 through 2010 Attendee Description: The toStaticHTML API, also known as the SafeHTML component, does not properly handle event...

Microsoft Releases June Security Bulletin

Microsoft has released updates to address vulnerabilities in Microsoft Windows, Internet Explorer, .NET Framework, Lync, and Dynamics AX as part of the Microsoft Security Bulletin Summary for June 2012. These vulnerabilities may allow an attacker to execute arbitrary code or operate with elevated...

Microsoft Windows TrueType Font Engine CVE-2012-0159 Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability that affects the TrueType Font engine. An attacker can exploit this issue through the Windows Kernel-Mode drivers to execute arbitrary code in kernel mode. The attacker can also exploit this issue through Microsoft...

Description of the update for Lync 2010: March 2012

Describes the issues that are fixed in the March 2012 update for Lync 2010.SummaryThis article describes the update for Microsoft Lync 2010 that is dated March 2012.This article describes the following items about the update package:The issues that the update package fixes.The prerequisites for...

Description of the update for Lync Server 2010: March 2012

Describes the update for Lync Server 2010 that is dated March 2012.SummaryThis article describes the update for Microsoft Lync Server 2010 that is dated March 2012. This article describes the following items about the update package:The issues that the update package fixes.The prerequisites for...

A DTMF-based IVR application that is developed by using Lync Server 2010, UCMA 3.0 Workflow APIs crashes

Fixes an issue in which a DTMF-based IVR application crashes when a user barges-in multiple times with invalid DTMF digits or barges-in to request help. This issue occurs if the application is developed by using Lync Server 2010, UCMA 3.0 Workflow APIs.SymptomsConsider the following scenario: You...

Description of the update package for Lync Server 2010, Web Components Server: March 2012

Describes the update for Lync Server 2010, Web Components Server that is dated March 2012.SummaryThis article describes the update for Microsoft Lync Server 2010, Web Components Server that is dated March 2012. INTRODUCTIONThis update improves the reliability, stability and performance of Lync...

Description of the update for Lync Server 2010, Web Components Server: December 2011

Describes the update for Lync Server 2010, Web Components Server that is dated December 2011.SummaryThis article describes the update for Microsoft Lync Server 2010, Web Components Server that is dated December 2011. ResolutionMicrosoft Download CenterThe following file is available for download...

Description of the update for Lync Server 2010 Bandwidth Policy Service: December 2011

Describes the update for Lync Server 2010 Bandwidth Policy Service that is dated December 2011.SummaryThis article describes the update for Microsoft Lync Server 2010 Bandwidth Policy Service that is dated December 2011.INTRODUCTIONIssues that this update fixesThis update fixes the following...

Description of the update for Lync Server 2010: December 2011

Describes the update for Lync Server 2010 that is dated December 2011.SummaryThis article describes the update for Microsoft Lync Server 2010 that is dated December 2011. ResolutionMicrosoft Download CenterThe following file is available for download from the Microsoft Download Center:Download th...

Microsoft Windows 'Win32k.sys' TrueType Font Handling Remote Code Execution Vulnerability

Description Microsoft Windows kernel is prone to a remote code-execution vulnerability. An attacker can exploit this issue by tricking an unsuspecting victim into opening a specially malformed TrueType font. Successful exploits can allow attackers to execute arbitrary code with kernel-level...

Microsoft Lync Web组件服务器"reachLocale"跨站脚本漏洞

Microsoft Lync Server是一款微软发布整合通讯解决方案 传递给WEB组件服务器Reach/Client/WebPages/ReachJoin.aspx脚本的"reachLocale"参数的输入在返回用户之前缺少过滤，攻击者可以利用漏洞进行跨站脚本攻击，可获得敏感信息或劫持用户会话 0 Microsoft Lync 2010 厂商解决方案 用户可参考如下供应商提供的安全公告获得补丁信息： http://support.microsoft.com/kb/2500441...

Javascript Injection in Microsoft Lync 4.0.7577.0

============================================================================ Foofus.net Security Advisory: foofus-20110610 ============================================================================ Title: Javascript Injection in Microsoft Lync Version: 4.0.7577.0 Vendor: Microsoft Release Date:...