Microsoft Skype For Business — known CVE vulnerabilities

Every CVE whose affected-product data names Microsoft Skype For Business, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (33)

• CVE-2016-7182 — CVSS 9.8 (critical): The Graphics component in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012…
• CVE-2020-1025 — CVSS 9.8 (critical): An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token…
• CVE-2015-6107 — CVSS 9.3 (critical): The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows…
• CVE-2015-6108 — CVSS 9.3 (critical): The Windows font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8; Windows 8.1; Windows…
• CVE-2015-2503 — CVSS 9.3 (critical): Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3…
• CVE-2015-6106 — CVSS 9.3 (critical): The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for…
• CVE-2017-11786 — CVSS 8.8 (high): Skype for Business in Microsoft Lync 2013 SP1 and Skype for Business 2016 allows an attacker to steal an authentication hash that can be…
• CVE-2018-8311 — CVSS 8.8 (high): A remote code execution vulnerability exists when Skype for Business and Microsoft Lync clients fail to properly sanitize specially crafted…
• CVE-2017-8527 — CVSS 8.8 (high): Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10…
• CVE-2017-0283 — CVSS 8.8 (high): Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10…
• CVE-2016-0145 — CVSS 8.8 (high): The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold…
• CVE-2024-20673 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2016-3301 — CVSS 7.8 (high): The Windows font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server…
• CVE-2016-3303 — CVSS 7.8 (high): The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010…
• CVE-2016-3304 — CVSS 7.8 (high): The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010…
• CVE-2016-3396 — CVSS 7.8 (high): Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1…
• CVE-2017-0108 — CVSS 7.8 (high): The Windows Graphics Component in Microsoft Office 2007 SP3; 2010 SP2; and Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010…
• CVE-2017-0281 — CVSS 7.8 (high): Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 2010 SP2,Office Web…
• CVE-2018-8238 — CVSS 7.8 (high): A security feature bypass vulnerability exists when Skype for Business or Lync do not properly parse UNC path links shared via messages…
• CVE-2017-8696 — CVSS 7.5 (high): Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for…
• CVE-2022-33633 — CVSS 7.2 (high): Skype for Business and Lync Remote Code Execution Vulnerability
• CVE-2019-1084 — CVSS 6.5 (medium): An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable…
• CVE-2018-8546 — CVSS 5.9 (medium): A denial of service vulnerability exists in Skype for Business, aka "Microsoft Skype for Business Denial of Service Vulnerability." This…
• CVE-2017-0060 — CVSS 5.5 (medium): The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows…
• CVE-2016-3263 — CVSS 5.5 (medium): Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1…
• CVE-2016-3262 — CVSS 5.5 (medium): Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1…
• CVE-2016-3209 — CVSS 5.5 (medium): Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1…
• CVE-2019-0624 — CVSS 5.4 (medium): A spoofing vulnerability exists when a Skype for Business 2015 server does not properly sanitize a specially crafted request, aka "Skype…
• CVE-2019-1490 — CVSS 5.4 (medium): A spoofing vulnerability exists when a Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for…
• CVE-2017-8695 — CVSS 5.3 (medium): Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT…
• CVE-2017-0073 — CVSS 4.3 (medium): The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows…
• CVE-2015-6061 — CVSS 4.3 (medium): Cross-site scripting (XSS) vulnerability in Microsoft Skype for Business 2016, Lync 2010 and 2013 SP1, Lync 2010 Attendee, and Lync Room…
• CVE-2017-8676 — CVSS 3.3 (low): The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server…