CVE-2015-6061: Microsoft Lync

Medium severity, CVSS 4.3. EPSS: 12.8% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in Microsoft Skype for Business 2016, Lync 2010 and 2013 SP1, Lync 2010 Attendee, and Lync Room System allows remote attackers to inject arbitrary web script or HTML via an instant-message session, aka "Server Input Validation Information Disclosure Vulnerability."

Affected products

• Microsoft Lync: version 2010 only; version 2013 only
• Microsoft Lync Room System: affected versions not specified
• Microsoft Skype For Business: version 2016 only

Published 2015-11-11. Last modified 2026-06-17.