Microsoft Office Communicator vulnerabilities

7 CVEs affecting Microsoft Office Communicator, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-1302, published 2013-05-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2008-5180, published 2008-11-20. Medium severity, CVSS 5.3. EPSS: 68% chance of exploitation in the next 30 days. Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of service (memory consumption) via a large number of SIP INVITE requests, which…
CVE-2012-2520, published 2012-10-09. Medium severity, CVSS 4.3. EPSS: 34.3% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Microsoft InfoPath 2007 SP2 and SP3 and 2010 SP1, Communicator 2007 R2, Lync 2010 and 2010 Attendee, SharePoint Server 2007 SP2 and SP3 and 2010 SP1,…
CVE-2012-1858, published 2012-06-12. Medium severity, CVSS 4.3. EPSS: 22% chance of exploitation in the next 30 days. The toStaticHTML API (aka the SafeHTML component) in Microsoft Internet Explorer 8 and 9, Communicator 2007 R2, and Lync 2010 and 2010 Attendee does not properly handle event attributes and script,…
CVE-2013-1302, published 2013-05-15. High severity, CVSS 9.3. EPSS: 21.9% chance of exploitation in the next 30 days. Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, and Lync Server 2013 do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via an invitation…
CVE-2008-3068, published 2008-07-07. High severity, CVSS 7.5. EPSS: 17.4% chance of exploitation in the next 30 days. Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a…
CVE-2008-5179, published 2008-11-20. Medium severity, CVSS 5.0. EPSS: 16.4% chance of exploitation in the next 30 days. Unspecified vulnerability in Microsoft Office Communications Server (OCS), Office Communicator, and Windows Live Messenger allows remote attackers to cause a denial of service (crash) via a crafted…
CVE-2008-5181, published 2008-11-20. Medium severity, CVSS 5.0. EPSS: 12.7% chance of exploitation in the next 30 days. Microsoft Communicator allows remote attackers to cause a denial of service (application or device outage) via instant messages containing large numbers of emoticons.