Opera Browser vulnerabilities

CVE-2007-6522 [MEDIUM] CWE-79 CVE-2007-6522: The rich text editing functionality in Opera before 9.25 allows remote attackers to conduct cross-do The rich text editing functionality in Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks by using designMode to modify contents of pages in other domains.

CVE-2008-4196 [MEDIUM] CWE-79 CVE-2008-4196: Cross-site scripting (XSS) vulnerability in Opera before 9.52 allows remote attackers to inject arbi Cross-site scripting (XSS) vulnerability in Opera before 9.52 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2009-3265 [MEDIUM] CWE-79 CVE-2009-3265: Cross-site scripting (XSS) vulnerability in Opera 9 and 10 allows remote attackers to inject arbitra Cross-site scripting (XSS) vulnerability in Opera 9 and 10 allows remote attackers to inject arbitrary web script or HTML via a (1) RSS or (2) Atom feed, related to the rendering of the application/rss+xml content type as "scripted content." NOTE: the vendor reportedly considers this behavior a "design feature," not a vulnerability.

CVE-2010-2659 [MEDIUM] CWE-200 CVE-2010-2659: Opera before 10.50 on Windows, before 10.52 on Mac OS X, and before 10.60 on UNIX platforms makes wi Opera before 10.50 on Windows, before 10.52 on Mac OS X, and before 10.60 on UNIX platforms makes widget properties accessible to third-party domains, which allows remote attackers to obtain potentially sensitive information via a crafted web site.

CVE-2012-6464 [MEDIUM] CWE-79 CVE-2012-6464: Cross-site scripting (XSS) vulnerability in Opera before 12.10 allows remote attackers to inject arb Cross-site scripting (XSS) vulnerability in Opera before 12.10 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript code that overrides methods of unspecified native objects in documents that have different origins.

CVE-2012-6463 [MEDIUM] CWE-79 CVE-2012-6463: Cross-site scripting (XSS) vulnerability in Opera before 12.10 allows remote attackers to inject arb Cross-site scripting (XSS) vulnerability in Opera before 12.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an unspecified sequence of loading of documents and loading of data: URLs.

CVE-2005-2309 [MEDIUM] CWE-400 CVE-2005-2309: Opera 8.01 allows remote attackers to cause a denial of service (CPU consumption) via a crafted JPEG Opera 8.01 allows remote attackers to cause a denial of service (CPU consumption) via a crafted JPEG image, as demonstrated using random.jpg.

CVE-2005-3007 [LOW] CWE-74 CVE-2005-3007: Opera before 8.50 allows remote attackers to spoof the content type of files via a filename with a t Opera before 8.50 allows remote attackers to spoof the content type of files via a filename with a trailing "." (dot), which might allow remote attackers to trick users into processing dangerous content.

CVE-2004-0872 [MEDIUM] CWE-669 CVE-2004-0872: Opera does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent ov Opera does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the same domain, which could allow remote attackers to steal cookies and conduct unauthorized activities, aka "Cross Security Boundary Cookie Injection."

CVE-2011-4686 [MEDIUM] CVE-2011-4686: Unspecified vulnerability in the Web Workers implementation in Opera before 11.60 allows remote atta Unspecified vulnerability in the Web Workers implementation in Opera before 11.60 allows remote attackers to cause a denial of service (application crash) via unknown vectors.

CVE-2010-1989 [MEDIUM] CVE-2010-1989: Opera 9.52 executes a mail application in situations where an IMG element has a SRC attribute that i Opera 9.52 executes a mail application in situations where an IMG element has a SRC attribute that is a redirect to a mailto: URL, which allows remote attackers to cause a denial of service (excessive application launches) via an HTML document with many images, a related issue to CVE-2010-0181.

CVE-2011-2625 [MEDIUM] CWE-399 CVE-2011-2625: Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via a SE Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via a SELECT element that contains many OPTION elements.

CVE-2011-2619 [MEDIUM] CWE-399 CVE-2011-2619: Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via a gr Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via a gradient with many stops, related to the implementation of CANVAS elements, SVG, and Cascading Style Sheets (CSS).

CVE-2011-2614 [MEDIUM] CWE-399 CVE-2011-2614: The SVG implementation in Opera before 11.50 allows remote attackers to cause a denial of service (a The SVG implementation in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via vectors involving a path on which many characters are drawn.

CVE-2011-2636 [MEDIUM] CVE-2011-2636: Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by a certain Tomato Firmware page.

CVE-2011-2622 [MEDIUM] CVE-2011-2622: Unspecified vulnerability in the Web Workers implementation in Opera before 11.50 allows remote atta Unspecified vulnerability in the Web Workers implementation in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via unknown vectors.

CVE-2005-3041 [MEDIUM] CVE-2005-3041: Unspecified "drag-and-drop vulnerability" in Opera Web Browser before 8.50 on Windows allows "uninte Unspecified "drag-and-drop vulnerability" in Opera Web Browser before 8.50 on Windows allows "unintentional file uploads."

CVE-2005-0238 [MEDIUM] CVE-2005-0238: The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain name The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.

CVE-2011-2633 [MEDIUM] CVE-2011-2633: Unspecified vulnerability in Opera before 11.11 allows remote attackers to cause a denial of service Unspecified vulnerability in Opera before 11.11 allows remote attackers to cause a denial of service (application crash) via vectors involving a Certificate Revocation List (CRL) file, as demonstrated by the multicert-ca-02.crl file.

CVE-2012-3563 [MEDIUM] CVE-2012-3563: Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via a web page that contains invalid character encodings.