Vulnerabilities for Office communicator (...) - CXSECURITY.COM

Vulnerabilities for 'Office communicator'

2013-05-14

CVE-2013-1302

CWE-119

Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, and Lync Server 2013 do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via an invitation that triggers access to a deleted object, aka "Lync RCE Vulnerability."

2012-10-09

CVE-2012-2520

CWE-79

Cross-site scripting (XSS) vulnerability in Microsoft InfoPath 2007 SP2 and SP3 and 2010 SP1, Communicator 2007 R2, Lync 2010 and 2010 Attendee, SharePoint Server 2007 SP2 and SP3 and 2010 SP1, Groove Server 2010 SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010 SP1, and Office Web Apps 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted string, aka "HTML Sanitization Vulnerability."

2012-06-12

CVE-2012-1858

CWE-200

The toStaticHTML API (aka the SafeHTML component) in Microsoft Internet Explorer 8 and 9, Communicator 2007 R2, and Lync 2010 and 2010 Attendee does not properly handle event attributes and script, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted HTML document, aka "HTML Sanitization Vulnerability."

2008-11-20

CVE-2008-5181

CWE-399

Microsoft Communicator allows remote attackers to cause a denial of service (application or device outage) via instant messages containing large numbers of emoticons.

CVE-2008-5180

CWE-399

Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of service (memory consumption) via a large number of SIP INVITE requests, which trigger the creation of many sessions.

CVE-2008-5179

CWE-noinfo

Unspecified vulnerability in Microsoft Office Communications Server (OCS), Office Communicator, and Windows Live Messenger allows remote attackers to cause a denial of service (crash) via a crafted Real-time Transport Control Protocol (RTCP) receiver report packet.

2008-07-07

CVE-2008-3068

CWE-Other

Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.

>>> Vendor: Microsoft 622 Products

Exchange server

Internet information server

Personal web server

Commerce server

Backoffice resource kit

Terminal server

Java virtual machine

Commercial internet system

Site server commerce

Outlook express

Windows explorer

Data access components

Zero administration kit

Msn setup bulletin board services

Visual interdev

Office converter pack

Systems management server

Virtual machine

Home publishing

Windows media services

Windows messaging

Windows media rights manager

Active movie control

Network monitor

Windows media player

Indexing service

Windows script host

Frontpage server extensions

Windows 2000 terminal services

Xml core services

Msn chat control

Msn messenger service for exchange

Windows 98 plus pack

Microsoft data access components

Metadirectory services

Content management server

Tsac activex control

Office web components

Ie for macintosh

.net windows server

Directx files viewer control

File transfer manager

Baseline security analyzer

Foundation class library

Windows 2003 server

Network firmware

See all Products for Vendor Microsoft

Copyright 2024, cxsecurity.com