EUVD-2020-12308

An information disclosure vulnerability exists when Skype for Business is accessed via Internet Explorer, aka 'Skype for Business via Internet Explorer Information Disclosure Vulnerability'...

CVE-2020-1432

CVE-2020-1432 is an information-disclosure vulnerability affecting Skype for Business when accessed through Internet Explorer. The CNVD entry describes IE11 as the affected component and notes exploitation could enable an attacker to obtain user information via a specially crafted URL (e.g., a ph...

CVE-2020-1025

CVE-2020-1025 affects Microsoft SharePoint Server and Skype for Business Server. The vulnerability is an elevation of privilege caused by improper OAuth token validation, enabling an attacker to bypass authentication by modifying the token. The published fixes modify how tokens are validated to a...

Microsoft Tackles 123 Fixes for July Patch Tuesday

A critical DNS bug and a publicly known elevation-of-privilege flaw top Microsoft’s July Patch Tuesday list of 123 fixes. The DNS flaw is a remote code-execution bug and is touted as one of the most critical Windows vulnerabilities released this year, earning the highest-severity CVSS score of 10...

Description of the security update for Skype for Business Server 2019 CU 2: July 14, 2020

None None...

Skype for Business via Internet Explorer Information Disclosure Vulnerability

An information disclosure vulnerability exists when Skype for Business is accessed via Internet Explorer. An attacker who exploited the vulnerability could cause the user to place a call without additional consent, leading to information disclosure of the user profile. For the vulnerability to be...

Description of the security update for Skype for Business Server 2015 CU 8: July 14, 2020

None None...

Microsoft Office Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation. An attacker who successfully exploited the vulnerability could bypass authentication and achieve improper access. To exploit this vulnerability, ...

Skype for Business via Microsoft Edge (EdgeHTML-based) Information Disclosure Vulnerability

An information disclosure vulnerability exists when Skype for Business is accessed via Microsoft Edge EdgeHTML-based. An attacker who exploited the vulnerability could cause the user to place a call without additional consent, leading to information disclosure of the user profile. For the...

PT-2020-3078 · Microsoft · Sharepoint Server +2

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Skype for Business Server affected versions not specified Description: An elevation of privilege issue occurs when Microsoft SharePoint Server and Skype for Business Server improperl...

KLA11858 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to obtain sensitive information, execute arbitrary code. Below is a complete list of vulnerabilities: 1. An information disclosure vulnerability in Skype for Business via Microsoft Edge...

Troves of Zoom Credentials Shared on Hacker Forums

Hackers have a new favorite topic of conversation on underground forums: How to obtain – and leverage – valuable credentials for Zoom, Skype, Webex and other web conferencing platforms increasingly used by remote workers. That’s what Etay Maor, chief security officer at IntSights, has discovered...

How An Image Could've Let Attackers Hack Microsoft Teams Accounts

Microsoft has patched a worm-like vulnerability in its Teams workplace video chat and collaboration platform that could have allowed attackers to take over an organization's entire roster of Teams accounts just by sending participants a malicious link to an innocent-looking image. The flaw,...

Skype Phishing Attack Targets Remote Workers' Passwords

Remote workers are being warned of a new phishing campaign targeting their Skype passwords. The phishing emails look “eerily similar” to a legitimate Skype notification alert, according to a report released by Cofense on Thursday. Emails indicate users have 13 pending Skype notifications that can...

Fake Skype, Signal Apps Used to Spread Surveillanceware

Cybercriminals are increasingly peddling booby-trapped version of popular apps such as Skype and Signal that contain surveillanceware. Apurva Kumar, security intelligence engineer at Lookout, said that one such surveillanceware family that’s been spotted using this tactic is Monokle, a...

MS15-116 and MS15-123: Description of the security update for Lync 2013 (Skype for Business): November 10, 2015

Resolves vulnerabilities in Lync 2013 and Skype for Business that could allow remote code execution or information disclosure.SummaryThis security update resolves vulnerabilities in Microsoft Lync 2013 and Skype for Business. These vulnerabilities could allow remote code execution if a user opens...

MS15-116 and MS15-123: Description of the security update for Skype for Business 2016: November 10, 2015

Resolves vulnerabilities in Skype for Business 2016 that could allow remote code execution or information disclosure.SummaryThis security update resolves vulnerabilities in Skype for Business 2016. These vulnerabilities could allow remote code execution if a user opens a specially crafted documen...

MS15-097: Description of the security update for Microsoft Lync 2013 (Skype for Business): September 8, 2015

Resolves vulnerabilities in Microsoft Lync 2013 that could allow remote code execution if a user opens a specially crafted document or goes to an untrusted webpage that contains embedded OpenType fonts.SummaryThis security update resolves vulnerabilities in Microsoft Lync 2013. These...

MS15-097: Description of the security update for Skype for Business 2016: September 30, 2015

Resolves vulnerabilities in Skype for Business 2016 that could allow remote code execution if a user opens a specially crafted document or goes to an untrusted webpage that contains embedded OpenType fonts.SummaryThis security update resolves vulnerabilities in Skype for Business 2016 that could...

ThreatList: Skype-Themed Apps Hide a Raft of Malware

Popular conferencing apps have become a major cybercrime lure during the COVID-19 work-from-home era – and Skype is the undisputed leader when it comes to being impersonated by malicious downloads, researchers have found. An April analysis from Kaspersky uncovered a total of 120,000 suspicious...