Feed subscription can cause the wrong page address to be displayed – Opera Security Advisories

Feed subscription can cause the wrong page address to be displayed – Opera Security Advisories OPCOM Team | December 16, 2008 Severity Not Severe Problem Description It has been reported that when a user subscribes to a news feed using the feed subscription button, the page address can be changed...

Sites can change framed content on other sites – Opera Security Advisories

Sites can change framed content on other sites – Opera Security Advisories OPCOM Team | December 16, 2008 Severity Highly Severe Problem Description Scripts are able to change the addresses of framed pages that come from the same site. Due to a flaw in the way that Opera checks what frames can be...

Opera 9.52/9.60 Stored Cross Site Scripting Code Exec PoC

No description provided by source. !-- Just found a way to use Stefano’s opera:config idea to execute code from remote. Instead of changing the HTTP Proxy, an attacker can change the default external mail application to “\evil\malware.exe ”, or to local commands e.g. ftp.exe which can be used to...

CVE-2008-4725

Cross-site scripting XSS vulnerability in Opera.dll in Opera 9.52 allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly escaped before storage in the History Search database aka md.dat, a different vector than CVE-2008-4696. NOTE: some of these...

CVE-2008-4725

CVE-2008-4725 describes a Cross-site scripting (XSS) vulnerability in Opera 9.52 related to History Search where query-string data is not properly escaped before storage in md.dat. The issue allows remote attackers to inject scripts via History Search results. Connected sources confirm Opera 9.52...

Opera 9.52/9.60 - Persistent Cross-Site Scripting Code Execution

bb var z=null; function x window.setTimeout"z=window.open'opera:historysearch?q=%2A';window.focus;",1500; window.setTimeout"z.close;",3000; window.setTimeout"location.href='mailto:'",3000; " onclick="x"Click me... s=document.createElement"IFRAME"; s.src="opera:config"; document.body.appendChilds;...

DoS vulnerability in Opera

Здравствуйте 3APA3A! Сообщаю вам о найденной мною новой Denial of Service уязвимости в Opera. Данная уязвимость является частью моего проекта Day of bugs in browsers http://websecurity.com.ua/2453/. DoS: Эксплоит: http://websecurity.com.ua/uploads/2008/Opera20DoS20Exploit3.html Уязвима версия Ope...

Opera 9.52 - Window Object Suppressing Remote Denial of Service

Opera Window Object Suppressing Remote Denial of Service. Version Affected: Opera 9.52 Severity: High Description: The opera browser is vulnerable to window object based denial of service attack. The opera fails to sanitize a check when window.close function is called in number of dynamically...

CVE-2008-4196

Cross-site scripting XSS vulnerability in Opera before 9.52 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-4195

Opera before 9.52 does not properly restrict the ability of a framed web page to change the address associated with a different frame, which allows remote attackers to trigger the display of an arbitrary address in a frame via unspecified use of web script...

PT-2008-5495 · Opera · Opera

Name of the Vulnerable Software and Affected Versions: Opera versions prior to 9.52 Description: The issue arises when Opera processes custom shortcut and menu commands, potentially producing argument strings that contain uninitialized memory. This could allow user-assisted remote attackers to...

CVE-2008-4196

CVE-2008-4196 concerns Opera before 9.52, with a cross-site scripting vulnerability that allows remote attackers to inject arbitrary script or HTML via unspecified vectors. Public advisories confirm this XSS issue as part of a set of Opera vulnerabilities reported in 2008. The connected documents...

CVE-2008-4200

The provided connected documentation confirms CVE-2008-4200 affects Opera prior to 9.52, where the address field of a news feed may not reflect the feed’s actual URL. This can allow a remote attacker to set the field to display the URL of a page containing script controlled by the attacker, enabl...