CVE-2009-3047

Opera before 10.00 is affected by a URL-spoofing vulnerability where a collapsed address bar fails to update the domain from the previous site to the current one, enabling a remote attacker to spoof URLs. The issue is documented across multiple sources (SUSE, Gentoo GLSA 201206-03, OpenVAS, and r...

CVE-2009-3044

Opera before 10.00 is affected by CVE-2009-3044 due to improper handling of a null character or invalid wildcard in the domain name in the X.509 certificate CN, enabling man‑in‑the‑middle spoofing of SSL servers via a certificate issued by a legitimate CA. The issue affects Opera’s certificate pa...

CVE-2009-3046

Opera before 10.00 is vulnerable because it does not check all intermediate X.509 certificates for revocation, allowing remote SSL servers to bypass certificate chain validation via a revoked certificate. Affected versions include Opera = 12.00.1467. This CVE is referenced in multiple advisories ...

CVE-2009-3049

Opera before 10.00 does not properly display all characters in Internationalized Domain Names IDN in the address bar, which allows remote attackers to spoof URLs and conduct phishing attacks, related to Unicode and Punycode...

CVE-2009-3048

Opera before 10.00 on Linux, Solaris, and FreeBSD is vulnerable due to improper handling of INPUT TYPE=file, enabling a remote attacker to trick a user into uploading an unintended file via a dropped-file vector. The issue is documented in CVE-2009-3048 and is echoed across multiple feeds (NVD en...

CVE-2009-3045

Opera before 10.00 trusts root X.509 certificates signed with the MD2 algorithm, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted server certificate...

CVE-2009-3048

Opera before 10.00 on Linux, Solaris, and FreeBSD does not properly implement the "INPUT TYPE=file" functionality, which allows remote attackers to trick a user into uploading an unintended file via vectors involving a "dropped file."...

CVE-2009-3046

Opera before 10.00 does not check all intermediate X.509 certificates for revocation, which makes it easier for remote SSL servers to bypass validation of the certificate chain via a revoked certificate...

CVE-2009-3044

Opera before 10.00 does not properly handle a 1 '\0' character or 2 invalid wildcard character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate...

CVE-2009-3045

Opera before 10.00 trusts root X.509 certificates signed with MD2, enabling MITM with a crafted server certificate and spoofing of SSL servers. Affected component is the browser’s certificate handling; the root cause is acceptance of MD2-signed certificates, which undermines TLS trust. In practic...

CVE-2009-3047

Opera before 10.00, when a collapsed address bar is used, does not properly update the domain name from the previously visited site to the currently visited site, which might allow remote attackers to spoof URLs...

Pwning Opera Unite with Inferno's Eleven

Pwning Opera Unite with Inferno's Eleven ---------------------------------------- Complete Post at http://securethoughts.com/2009/08/pwning-opera-unite-with-infernos-eleven/ Opera Unite, the upcoming version of the Opera browser has a strong vision to change how we look at the web. For those who...

PT-2009-5378 · Opera · Opera

Name of the Vulnerable Software and Affected Versions: Opera versions prior to 10.00 Description: The issue arises from the failure to check all intermediate X.509 certificates for revocation, making it easier for remote SSL servers to bypass validation of the certificate chain via a revoked...

Opera Unite multiple security vulnerabilities

Request spoofing, crossite scripting, information leak, etc...

Opera < 10.00 Multiple Vulnerabilities

Binary data 800811.prm...

Opera < 10.00 Multiple Vulnerabilities

Binary data 5146.prm...

Opera < 10.0 Multiple Vulnerabilities

The version of Opera installed on the remote host is earlier than 10.0 and thus reportedly affected by multiple issues : - Opera does not check the revocation status for intermediate certificates not served by the server. If the intermediate is revoked, this might not impact the security rating i...

opera -- multiple vulnerabilities

Opera Team Reports: Issue where sites using revoked intermediate certificates might be shown as secure Issue where the collapsed address bar didn't show the current domain Issue where pages could trick users into uploading files Some IDNA characters not correctly displaying in the address bar Iss...

CVE-2009-3013

Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting a Location header that contains JavaScript sequences in a...

Cross site scripting

Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting a Location header that contains JavaScript sequences in a...