4.3

CVE-2015-6061

Cross-site scripting (XSS) vulnerability in Microsoft Skype for Business 2016, Lync 2010 and 2013 SP1, Lync 2010 Attendee, and Lync Room System allows remote attackers to inject arbitrary web script or HTML via an instant-message session, aka "Server Input Validation Information Disclosure Vulnerability."
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Lync Version 2010 HwPlatform x64
Microsoft ≫ Lync Version 2010 HwPlatform x86
Microsoft ≫ Lync Version 2010 SwEdition attendee
Microsoft ≫ Lync Version 2013 Update sp1 HwPlatform x64
Microsoft ≫ Lync Version 2013 Update sp1 HwPlatform x86
Microsoft ≫ Lync Room System Version -
Microsoft ≫ Skype For Business Version 2016
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 12.81% 0.958
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://www.securitytracker.com/id/1034126
http://www.securitytracker.com/id/1034127
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-123