CVE-2008-0454

The CVE-2008-0454 entry concerns Skype on Windows where cross-zone scripting is possible through the Internet Explorer web control. Specifically, in Skype 3.6.0.244 (and earlier 3.5.x/3.6.x), a user-assisted attacker could inject arbitrary web script/HTML in the Local Machine Zone via the Title f...

CVE-2007-4429

Skype exposure CVE-2007-4429 describes an unspecified vulnerability that could allow remote attackers to cause a denial of service (server hang) by sending long URIs. The description notes active exploitation around 2007-08-17 via a call to a specific number and clarifies the issue is separate fr...

CVE-2008-0582

CVE-2008-0582 affects Skype on Windows (versions 3.1–3.6.0.244). The issue is a cross-zone scripting vulnerability in the Internet Explorer web control used by SkypeFind, allowing an attacker to inject script/HTML into the Local Machine Zone via the Full Name field of a reviewer in a business ite...

CVE-2005-3267

CVE-2005-3267 affects Skype clients on Windows (pre-1.4.x.84), macOS (pre-1.3.x.17), Linux (pre-1.2.x.18), and older 1.1.x.6 and earlier. An integer overflow in handling crafted network data (large Object Counter) triggers a heap-based buffer overflow, leading to remote denial of service (crash);...

CVE-2008-1805

CVE-2008-1805 affects Skype: incomplete blacklist in the file:// URI handling allows user-assisted remote attackers to bypass the security warning and possibly execute arbitrary code via a URL ending in an executable extension not covered by the blacklist. Reported for Skype 3.6.0.248 and other v...

CVE-2008-0583

CVE-2008-0583 describes a cross-zone scripting vulnerability in the Internet Explorer web control used by Skype 3.6.0.244 and older 3.5.x/3.6.x builds. The issue allows user-assisted remote attackers to inject arbitrary web script or HTML into the Local Machine Zone via metadata fields (Descripti...

CVE-2008-2545

CVE-2008-2545 affects Skype 3.6.0.248 and earlier than 3.8.0.139. The issue is a case-sensitive comparison in the file: URI handling for dangerous extensions, which can bypass warning dialogs and potentially allow user-assisted remote code execution when a crafted file: URI with a mismatched case...

CVE-2007-5989

The CVE-2007-5989 issue affects Skype

CVE-2004-1114

CVE-2004-1114 : Affected software is Skype for Windows, versions 1.0.x.94–1.0.x.98. The issue is a buffer overflow in the handling of command line arguments, triggered by a long non-existent username in a callto:// URL. This could allow remote attackers to execute arbitrary code. The CVE is disti...

CVE-2004-1777

CVE-2004-1777 describes a range-check error in Skype for Windows prior to 0.98.0.28 that can be triggered by excessively long command line arguments or a long callto:// URL, leading to a denial of service (application crash). The issue affects Skype for Windows versions before 0.98.0.28 and is di...

CVE-2005-3265

The CVE-2005-3265 issue is a buffer overflow in Skype for Windows 1.1.x.0–1.4.x.83 that can be triggered via callto://, skype://, or a malformed VCARD. The underlying fault is described as an error in the Delphi routine SysUtils.WideFmtStr, potentially leading to remote code execution in the cont...

CVE-2005-2300

CVE-2005-2300 (Skype) affects Skype versions up to 1.1.0.20. The flaw enables a local user to overwrite arbitrary files via a symlink attack on the temporary file skype_profile.jpg. The NVD entry lists a local access vector with low base score (2.1) and partial integrity impact; confidentiality a...

CVE-2005-1407

CVE-2005-1407 affects Skype for Windows versions 1.2.0.0 through 1.2.0.46. The issue allows a local user to bypass the identity check for an authorized application and then call arbitrary Skype API functions by modifying or replacing that application. The underlying impact is limited to a local e...

CVE-2006-5084

The connected CERT/NVD entries confirm a format-string vulnerability in Skype for Mac’s NSRunAlertPanel when handling Skype URIs (e.g., skype://) in versions up to 1.5..79, enabling remote attackers to cause crash and potentially execute arbitrary code. Impact is user-level via a crafted URI; no ...