CVSS: 9.3EPSS: 80%CPEs: 5EXPL: 0CVE-2013-1302
https://notcve.org/view.php?id=CVE-2013-1302
Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, and Lync Server 2013 do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via an invitation that triggers access to a deleted object, aka "Lync RCE Vulnerability." Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, y Lync Server 2013 no maneja correctamente ojbetos en memoria, lo que permite a atacantes remotos ejecutar código arbitrario mediante una invitación que genera el acceso a un objeto eliminado, también conocido como "Vulnerabilidad • http://www.us-cert.gov/ncas/alerts/TA13-134A https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-041 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15952 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 15%CPEs: 12EXPL: 0CVE-2012-2520
https://notcve.org/view.php?id=CVE-2012-2520
Cross-site scripting (XSS) vulnerability in Microsoft InfoPath 2007 SP2 and SP3 and 2010 SP1, Communicator 2007 R2, Lync 2010 and 2010 Attendee, SharePoint Server 2007 SP2 and SP3 and 2010 SP1, Groove Server 2010 SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010 SP1, and Office Web Apps 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted string, aka "HTML Sanitization Vulnerability." Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Microsoft InfoPath 2007 SP2 y SP3 y 2010 SP1, Communicator 2007 R2, Lync 2010 y 2010 Attendee, SharePoint Server 2007 SP2 y SP3 and 2010 SP1, Groove Server 2010 SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010 SP1, y Office Web Apps 2010 SP1, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de una cadena modificada, también conocido como "HTML Sanitization Vulnerability." • http://www.securityfocus.com/bid/55797 http://www.securitytracker.com/id?1027625 http://www.securitytracker.com/id?1027626 http://www.securitytracker.com/id?1027627 http://www.securitytracker.com/id?1027628 http://www.securitytracker.com/id? • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 95%CPEs: 30EXPL: 1CVE-2012-1858 – Microsoft Internet Explorer 9 / SharePoint / Lync - toStaticHTML HTML Sanitizing Bypass (MS12-037/MS12-039/MS12-050)
https://notcve.org/view.php?id=CVE-2012-1858
The toStaticHTML API (aka the SafeHTML component) in Microsoft Internet Explorer 8 and 9, Communicator 2007 R2, and Lync 2010 and 2010 Attendee does not properly handle event attributes and script, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted HTML document, aka "HTML Sanitization Vulnerability." La API toStaticHTML (también conocido como componente SafeHTML) en Microsoft Internet Explorer v8 y v9, Communicator 2007 R2, y Lync 2010 y 2010 Attendee no maneja de forma correcta atributos de eventos y secuencias de comandos, lo que facilita a atacantes remotos conducir ataques de ejecución de secuencias de comandos en sitios cruzados (XSS) a través de un documento HTML manipulado, también conocido como "HTML Sanitization Vulnerability." The *toStaticHTML* component, which is found in Internet Explorer versions greater than 8, SharePoint and Lync is used to sanitize HTML fragments from dynamic and potentially malicious content. An attacker is able to create a specially formed CSS that will overcome * toStaticHTML*'s security logic; therefore, after passing the specially crafted CSS string through the *toStaticHTML* function, it will contain an expression that triggers a JavaScript call. • https://www.exploit-db.com/exploits/19777 http://www.us-cert.gov/cas/techalerts/TA12-164A.html http://www.us-cert.gov/cas/techalerts/TA12-192A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-037 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-050 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15530 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 2%CPEs: 1EXPL: 0CVE-2008-5181
https://notcve.org/view.php?id=CVE-2008-5181
Microsoft Communicator allows remote attackers to cause a denial of service (application or device outage) via instant messages containing large numbers of emoticons. Microsoft Communicator permite a atacantes remotos producir una denegación de servicio (agotamiento de aplicación o dispositivo) a través de mensajes instantáneos que contienen un gran numero de emoticonos. • http://www.securitytracker.com/id?1021294 http://www.voipshield.com/research-details.php?id=131 https://exchange.xforce.ibmcloud.com/vulnerabilities/46671 • CWE-399: Resource Management Errors •
CVSS: 5.3EPSS: 61%CPEs: 1EXPL: 3CVE-2008-5180 – Microsoft Office - Communicator 'SIP' Remote Denial of Service
https://notcve.org/view.php?id=CVE-2008-5180
Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of service (memory consumption) via a large number of SIP INVITE requests, which trigger the creation of many sessions. Microsoft Communicator permite a atacantes remotos causar una denegación de servicio (consumo de memoria) a través de un gran numero de solicitudes SIP INVITE que produce la creación de muchas sesiones. • https://www.exploit-db.com/exploits/7262 https://www.exploit-db.com/exploits/12079 http://secunia.com/advisories/32940 http://www.exploit-db.com/exploits/12079 http://www.securityfocus.com/bid/39221 http://www.securitytracker.com/id?1021294 http://www.voipshield.com/research-details.php?id=133 https://exchange.xforce.ibmcloud.com/vulnerabilities/46673 https://exchange.xforce.ibmcloud.com/vulnerabilities/57581 • CWE-770: Allocation of Resources Without Limits or Throttling •