4497 matches found
Code injection
Opera before 10.00 does not properly display all characters in Internationalized Domain Names IDN in the address bar, which allows remote attackers to spoof URLs and conduct phishing attacks, related to Unicode and Punycode...
Input validation
Opera before 10.00 does not check all intermediate X.509 certificates for revocation, which makes it easier for remote SSL servers to bypass validation of the certificate chain via a revoked certificate...
Input validation
Opera before 10.00 on Linux, Solaris, and FreeBSD does not properly implement the "INPUT TYPE=file" functionality, which allows remote attackers to trick a user into uploading an unintended file via vectors involving a "dropped file."...
CVE-2009-3044
Opera before 10.00 does not properly handle a 1 '\0' character or 2 invalid wildcard character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate...
CVE-2009-3049
Opera before 10.00 has an IDN in the address bar display bug that can enable URL spoofing and phishing via Unicode/Punycode handling. The connected advisories/documentation confirm multiple CVEs (including CVE-2009-3049) tied to IDN spoofing vulnerabilities. Practical impact: remote attackers cou...
CVE-2009-3047
Opera before 10.00 is affected by a URL-spoofing vulnerability where a collapsed address bar fails to update the domain from the previous site to the current one, enabling a remote attacker to spoof URLs. The issue is documented across multiple sources (SUSE, Gentoo GLSA 201206-03, OpenVAS, and r...
CVE-2009-3048
Opera before 10.00 on Linux, Solaris, and FreeBSD does not properly implement the "INPUT TYPE=file" functionality, which allows remote attackers to trick a user into uploading an unintended file via vectors involving a "dropped file."...
CVE-2009-3046
Opera before 10.00 is vulnerable because it does not check all intermediate X.509 certificates for revocation, allowing remote SSL servers to bypass certificate chain validation via a revoked certificate. Affected versions include Opera = 12.00.1467. This CVE is referenced in multiple advisories ...
CVE-2009-3045
Opera before 10.00 trusts root X.509 certificates signed with the MD2 algorithm, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted server certificate...
CVE-2009-3048
Opera before 10.00 on Linux, Solaris, and FreeBSD is vulnerable due to improper handling of INPUT TYPE=file, enabling a remote attacker to trick a user into uploading an unintended file via a dropped-file vector. The issue is documented in CVE-2009-3048 and is echoed across multiple feeds (NVD en...
CVE-2009-3044
Opera before 10.00 is affected by CVE-2009-3044 due to improper handling of a null character or invalid wildcard in the domain name in the X.509 certificate CN, enabling man‑in‑the‑middle spoofing of SSL servers via a certificate issued by a legitimate CA. The issue affects Opera’s certificate pa...
CVE-2009-3049
Opera before 10.00 does not properly display all characters in Internationalized Domain Names IDN in the address bar, which allows remote attackers to spoof URLs and conduct phishing attacks, related to Unicode and Punycode...
CVE-2009-3046
Opera before 10.00 does not check all intermediate X.509 certificates for revocation, which makes it easier for remote SSL servers to bypass validation of the certificate chain via a revoked certificate...
CVE-2009-3047
Opera before 10.00, when a collapsed address bar is used, does not properly update the domain name from the previously visited site to the currently visited site, which might allow remote attackers to spoof URLs...
CVE-2009-3044
Opera before 10.00 does not properly handle a 1 '\0' character or 2 invalid wildcard character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate...
CVE-2009-3045
Opera before 10.00 trusts root X.509 certificates signed with MD2, enabling MITM with a crafted server certificate and spoofing of SSL servers. Affected component is the browser’s certificate handling; the root cause is acceptance of MD2-signed certificates, which undermines TLS trust. In practic...
Pwning Opera Unite with Inferno's Eleven
Pwning Opera Unite with Inferno's Eleven ---------------------------------------- Complete Post at http://securethoughts.com/2009/08/pwning-opera-unite-with-infernos-eleven/ Opera Unite, the upcoming version of the Opera browser has a strong vision to change how we look at the web. For those who...
PT-2009-5378 · Opera · Opera
Name of the Vulnerable Software and Affected Versions: Opera versions prior to 10.00 Description: The issue arises from the failure to check all intermediate X.509 certificates for revocation, making it easier for remote SSL servers to bypass validation of the certificate chain via a revoked...
