Microsoft Skype for Business Server and Microsoft Lync Information Dislcosure Vulnerability

An information disclosure vulnerability exists when Skype for Business and Microsoft Lync clients improperly sanitize specially crafted content. An attacker who successfully exploited the vulnerability could execute HTML and JavaScript content in the Skype for Business or Lync context. The attacker could use this vulnerability to open a webpage using the default browser, open another messaging session with a third party, or potentially trigger URIs that are defined by other applications on the client's system.