Opera Browser vulnerabilities

CVE-2010-4043 [MEDIUM] CWE-264 CVE-2010-4043: Opera before 10.63 does not prevent interpretation of a cross-origin document as a CSS stylesheet wh Opera before 10.63 does not prevent interpretation of a cross-origin document as a CSS stylesheet when the document lacks a CSS token sequence, which allows remote attackers to obtain sensitive information via a crafted document.

CVE-2007-6522 [MEDIUM] CWE-79 CVE-2007-6522: The rich text editing functionality in Opera before 9.25 allows remote attackers to conduct cross-do The rich text editing functionality in Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks by using designMode to modify contents of pages in other domains.

CVE-2009-2351 [MEDIUM] CVE-2009-2351: Opera 9.52 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which a Opera 9.52 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header, a related issue to CVE-2009-1312. NOTE: it was later reported that 10.00 Beta 3 Build 1

CVE-2010-2455 [MEDIUM] CVE-2010-2455: Opera does not properly manage the address bar between the request to open a URL and the retrieval o Opera does not properly manage the address bar between the request to open a URL and the retrieval of the new document's content, which might allow remote attackers to conduct spoofing attacks via a crafted HTML document, a related issue to CVE-2010-1206.

CVE-2008-5682 [MEDIUM] CWE-79 CVE-2008-5682: Cross-site scripting (XSS) vulnerability in Opera before 9.63 allows remote attackers to inject arbi Cross-site scripting (XSS) vulnerability in Opera before 9.63 allows remote attackers to inject arbitrary web script or HTML via built-in XSLT templates.

CVE-2005-3946 [MEDIUM] CWE-20 CVE-2005-3946: Opera 8.50 allows remote attackers to cause a denial of service (crash) via a Java applet with a lar Opera 8.50 allows remote attackers to cause a denial of service (crash) via a Java applet with a large string argument to the removeMember JNI method for the com.opera.JSObject class.

CVE-2006-3945 [MEDIUM] CWE-787 CVE-2006-3945: The CSS functionality in Opera 9 on Windows XP SP2 allows remote attackers to cause a denial of serv The CSS functionality in Opera 9 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by setting the background property of a DHTML element to a long http or https URL, which triggers memory corruption.

CVE-2011-0686 [MEDIUM] CVE-2011-0686: Unspecified vulnerability in Opera before 11.01 allows remote attackers to cause a denial of service Unspecified vulnerability in Opera before 11.01 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by vkontakte.ru.

CVE-2011-2613 [MEDIUM] CWE-399 CVE-2011-2613: The Array.prototype.join method in Opera before 11.50 allows remote attackers to cause a denial of s The Array.prototype.join method in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via a non-array object that contains initial holes.

CVE-2011-2612 [MEDIUM] CVE-2011-2612: Unspecified vulnerability in Opera before 11.50 allows remote attackers to cause a denial of service Unspecified vulnerability in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by progorod.ru.

CVE-2011-2638 [MEDIUM] CVE-2011-2638: Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by games on zylom.com.

CVE-2011-2637 [MEDIUM] CVE-2011-2637: Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by futura-sciences.com, seoptimise.com, and mitosyfraudes.org.

CVE-2011-2627 [MEDIUM] CVE-2011-2627: Unspecified vulnerability in the DOM implementation in Opera before 11.50 allows remote attackers to Unspecified vulnerability in the DOM implementation in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by live.com.

CVE-2011-4685 [MEDIUM] CWE-20 CVE-2011-4685: Dragonfly in Opera before 11.60 allows remote attackers to cause a denial of service (application cr Dragonfly in Opera before 11.60 allows remote attackers to cause a denial of service (application crash) via unspecified content on a web page, as demonstrated by forbes.com.

CVE-2012-3568 [MEDIUM] CVE-2012-3568: Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via crafted WebGL content, as demonstrated by a codeflow.org WebGL demo.

CVE-2003-1420 [MEDIUM] CWE-79 CVE-2003-1420: Cross-site scripting (XSS) vulnerability in Opera 6.0 through 7.0 with automatic redirection disable Cross-site scripting (XSS) vulnerability in Opera 6.0 through 7.0 with automatic redirection disabled allows remote attackers to inject arbitrary web script or HTML via the HTTP Location header.

CVE-2010-3021 [MEDIUM] CWE-399 CVE-2010-3021: Unspecified vulnerability in Opera before 10.61 allows remote attackers to cause a denial of service Unspecified vulnerability in Opera before 10.61 allows remote attackers to cause a denial of service (CPU consumption and application hang) via an animated PNG image.

CVE-2010-2663 [MEDIUM] CVE-2010-2663: Opera before 10.60 allows remote attackers to cause a denial of service (application hang) via an en Opera before 10.60 allows remote attackers to cause a denial of service (application hang) via an ended event handler that changes the SRC attribute of an AUDIO element.

CVE-2009-3013 [MEDIUM] CWE-79 CVE-2009-3013: Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly block data: URIs in Location Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Location header that contains JavaScript sequences in a data:text/html URI or (2) entering a data:text/html URI w

CVE-2007-6520 [MEDIUM] CWE-79 CVE-2007-6520: Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks via unknown vect Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks via unknown vectors related to plug-ins.