Security Vulnerabilities
Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.
CVSS Score
6.5
EPSS Score
0.003
Published
2026-09-08
Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.
CVSS Score
7.1
EPSS Score
0.003
Published
2026-09-08
Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network.
CVSS Score
6.5
EPSS Score
0.005
Published
2026-09-08
Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network.
CVSS Score
7.5
EPSS Score
0.006
Published
2026-09-08
Out-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network.
CVSS Score
6.5
EPSS Score
0.006
Published
2026-09-08
Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.
CVSS Score
6.5
EPSS Score
0.007
Published
2026-09-08
External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.
CVSS Score
9.8
EPSS Score
0.005
Published
2026-09-08
Null pointer dereference in Skype for Business allows an authorized attacker to deny service over a network.
CVSS Score
6.5
EPSS Score
0.008
Published
2026-09-08
Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network.
CVSS Score
7.5
EPSS Score
0.007
Published
2026-09-08
In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score
7.3
EPSS Score
0.001
Published
2026-09-08