Opera Browser vulnerabilities

CVE-2007-6522 [MEDIUM] CWE-79 CVE-2007-6522: The rich text editing functionality in Opera before 9.25 allows remote attackers to conduct cross-do The rich text editing functionality in Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks by using designMode to modify contents of pages in other domains.

CVE-2009-2351 [MEDIUM] CVE-2009-2351: Opera 9.52 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which a Opera 9.52 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header, a related issue to CVE-2009-1312. NOTE: it was later reported that 10.00 Beta 3 Build 1

CVE-2010-2455 [MEDIUM] CVE-2010-2455: Opera does not properly manage the address bar between the request to open a URL and the retrieval o Opera does not properly manage the address bar between the request to open a URL and the retrieval of the new document's content, which might allow remote attackers to conduct spoofing attacks via a crafted HTML document, a related issue to CVE-2010-1206.

CVE-2008-5682 [MEDIUM] CWE-79 CVE-2008-5682: Cross-site scripting (XSS) vulnerability in Opera before 9.63 allows remote attackers to inject arbi Cross-site scripting (XSS) vulnerability in Opera before 9.63 allows remote attackers to inject arbitrary web script or HTML via built-in XSLT templates.

CVE-2005-3946 [MEDIUM] CWE-20 CVE-2005-3946: Opera 8.50 allows remote attackers to cause a denial of service (crash) via a Java applet with a lar Opera 8.50 allows remote attackers to cause a denial of service (crash) via a Java applet with a large string argument to the removeMember JNI method for the com.opera.JSObject class.

CVE-2005-2309 [MEDIUM] CWE-400 CVE-2005-2309: Opera 8.01 allows remote attackers to cause a denial of service (CPU consumption) via a crafted JPEG Opera 8.01 allows remote attackers to cause a denial of service (CPU consumption) via a crafted JPEG image, as demonstrated using random.jpg.

CVE-2006-3945 [MEDIUM] CWE-787 CVE-2006-3945: The CSS functionality in Opera 9 on Windows XP SP2 allows remote attackers to cause a denial of serv The CSS functionality in Opera 9 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by setting the background property of a DHTML element to a long http or https URL, which triggers memory corruption.

CVE-2011-0686 [MEDIUM] CVE-2011-0686: Unspecified vulnerability in Opera before 11.01 allows remote attackers to cause a denial of service Unspecified vulnerability in Opera before 11.01 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by vkontakte.ru.

CVE-2011-2613 [MEDIUM] CWE-399 CVE-2011-2613: The Array.prototype.join method in Opera before 11.50 allows remote attackers to cause a denial of s The Array.prototype.join method in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via a non-array object that contains initial holes.

CVE-2011-2612 [MEDIUM] CVE-2011-2612: Unspecified vulnerability in Opera before 11.50 allows remote attackers to cause a denial of service Unspecified vulnerability in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by progorod.ru.

CVE-2011-2638 [MEDIUM] CVE-2011-2638: Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by games on zylom.com.

CVE-2011-2637 [MEDIUM] CVE-2011-2637: Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by futura-sciences.com, seoptimise.com, and mitosyfraudes.org.

CVE-2011-2627 [MEDIUM] CVE-2011-2627: Unspecified vulnerability in the DOM implementation in Opera before 11.50 allows remote attackers to Unspecified vulnerability in the DOM implementation in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by live.com.

CVE-2011-4685 [MEDIUM] CWE-20 CVE-2011-4685: Dragonfly in Opera before 11.60 allows remote attackers to cause a denial of service (application cr Dragonfly in Opera before 11.60 allows remote attackers to cause a denial of service (application crash) via unspecified content on a web page, as demonstrated by forbes.com.

CVE-2012-3568 [MEDIUM] CVE-2012-3568: Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via crafted WebGL content, as demonstrated by a codeflow.org WebGL demo.

CVE-2010-3021 [MEDIUM] CWE-399 CVE-2010-3021: Unspecified vulnerability in Opera before 10.61 allows remote attackers to cause a denial of service Unspecified vulnerability in Opera before 10.61 allows remote attackers to cause a denial of service (CPU consumption and application hang) via an animated PNG image.

CVE-2010-2663 [MEDIUM] CVE-2010-2663: Opera before 10.60 allows remote attackers to cause a denial of service (application hang) via an en Opera before 10.60 allows remote attackers to cause a denial of service (application hang) via an ended event handler that changes the SRC attribute of an AUDIO element.

CVE-2009-3013 [MEDIUM] CWE-79 CVE-2009-3013: Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly block data: URIs in Location Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Location header that contains JavaScript sequences in a data:text/html URI or (2) entering a data:text/html URI w

CVE-2007-6520 [MEDIUM] CWE-79 CVE-2007-6520: Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks via unknown vect Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks via unknown vectors related to plug-ins.

CVE-2012-1931 [MEDIUM] CWE-264 CVE-2012-1931: Opera before 11.62 on UNIX, when used in conjunction with an unspecified printing application, allow Opera before 11.62 on UNIX, when used in conjunction with an unspecified printing application, allows local users to overwrite arbitrary files via a symlink attack on a temporary file during printing.