Lucene search

K

Opera Security Vulnerabilities

cve
cve

CVE-2008-4197

Opera before 9.52 on Windows, Linux, FreeBSD, and Solaris, when processing custom shortcut and menu commands, can produce argument strings that contain uninitialized memory, which might allow user-assisted remote attackers to execute arbitrary code or conduct other attacks via vectors related to...

8.8CVSS

8.8AI Score

0.083EPSS

2008-09-27 10:30 AM
20
cve
cve

CVE-2009-3046

Opera before 10.00 does not check all intermediate X.509 certificates for revocation, which makes it easier for remote SSL servers to bypass validation of the certificate chain via a revoked...

7.5CVSS

7.3AI Score

0.003EPSS

2009-09-02 05:30 PM
31
cve
cve

CVE-2009-2540

Opera, possibly 9.64 and earlier, allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object, a related issue to...

6.5AI Score

0.033EPSS

2009-07-20 06:30 PM
29
cve
cve

CVE-2011-0682

Integer truncation error in opera.dll in Opera before 11.01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTML form with a select element that contains a large number of...

7.8AI Score

0.049EPSS

2011-01-31 09:00 PM
26
cve
cve

CVE-2019-18624

Opera Mini for Android allows attackers to bypass intended restrictions on .apk file download/installation via an RTLO (aka Right to Left Override) approach, as demonstrated by misinterpretation of malicious%E2%80%AEtxt.apk as maliciouskpa.txt. This affects 44.1.2254.142553, 44.1.2254.142659, and.....

9.8CVSS

9.1AI Score

0.006EPSS

2019-10-29 07:15 PM
19
cve
cve

CVE-2013-1489

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 10 and Update 11, when running on Windows using Internet Explorer, Firefox, Opera, and Google Chrome, allows remote attackers to bypass the "Very High" security level of the Java Control Panel and.....

6.3AI Score

0.023EPSS

2013-01-31 02:55 PM
125
cve
cve

CVE-2015-4000

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then....

3.7CVSS

4.8AI Score

0.974EPSS

2015-05-21 12:59 AM
872
In Wild
2
cve
cve

CVE-2015-8960

The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations with a client secret key and server public key but not a...

8.1CVSS

7.8AI Score

0.006EPSS

2016-09-21 02:59 AM
35
cve
cve

CVE-2018-16135

The Opera Mini application 47.1.2249.129326 for Android allows remote attackers to spoof the Location Permission dialog via a crafted web...

6.5CVSS

6.2AI Score

0.001EPSS

2022-12-26 10:15 PM
30
cve
cve

CVE-2011-3389

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext...

6.5AI Score

0.009EPSS

2011-09-06 07:55 PM
412
2
cve
cve

CVE-2009-2059

Opera, possibly before 9.25, uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering"...

7.3AI Score

0.002EPSS

2022-10-03 04:24 PM
24
cve
cve

CVE-2002-2358

Cross-site scripting (XSS) vulnerability in the FTP view feature in Opera 6.0 and 6.01 through 6.04 allows remote attackers to inject arbitrary web script or HTML via the title tag of an FTP...

6AI Score

0.002EPSS

2022-10-03 04:23 PM
15
cve
cve

CVE-2002-2312

Opera 6.0.1 allows remote attackers to upload arbitrary file contents when users press a key corresponding to the JavaScript (1) event.ctrlKey or (2) event.shiftKey onkeydown event contained in a...

7.2AI Score

0.005EPSS

2022-10-03 04:23 PM
21
cve
cve

CVE-2002-2332

Buffer overflow in Opera 6.01 allows remote attackers to cause a denial of service (crash) via an IMG tag with large width and height...

7.3AI Score

0.006EPSS

2022-10-03 04:23 PM
22
cve
cve

CVE-2002-2311

Microsoft Internet Explorer 6.0 and possibly others allows remote attackers to upload arbitrary file contents when users press a key corresponding to the JavaScript (1) event.ctrlKey or (2) event.shiftKey onkeydown event contained in a webpage. NOTE: it was reported that the vendor has disputed...

7.2AI Score

0.017EPSS

2022-10-03 04:23 PM
22
cve
cve

CVE-2005-2309

Opera 8.01 allows remote attackers to cause a denial of service (CPU consumption) via a crafted JPEG image, as demonstrated using...

6.9AI Score

0.002EPSS

2022-10-03 04:22 PM
15
cve
cve

CVE-2005-4718

Opera 8.02 and earlier allows remote attackers to cause a denial of service (client crash) via (1) a crafted HTML file with a "content: url(0);" style attribute, a "bodyA" tag, a long string, and a "u" tag with a long attribute, as demonstrated by opera.html; and (2) a BGSOUND element with a...

6.8AI Score

0.018EPSS

2022-10-03 04:22 PM
20
cve
cve

CVE-2005-1669

Cross-site scripting (XSS) vulnerability in Opera 8.0 Final Build 1095 allows remote attackers to inject arbitrary web script or HTML via "javascript:" URLs when a new window or frame is opened, which allows remote attackers to bypass access restrictions and perform unauthorized actions on other...

5.7AI Score

0.003EPSS

2022-10-03 04:22 PM
33
cve
cve

CVE-2005-3699

Opera Web Browser 8.50 and 8.0 through 8.0.2 allows remote attackers to spoof the URL in the status bar via the title in an image in a link to a trusted site within a form to the malicious...

6.5AI Score

0.001EPSS

2022-10-03 04:22 PM
22
cve
cve

CVE-2010-5068

The Cascading Style Sheets (CSS) implementation in Opera 10.5 does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document, a related issue to...

5.6AI Score

0.005EPSS

2022-10-03 04:21 PM
24
cve
cve

CVE-2010-5072

The JavaScript implementation in Opera 10.5 does not properly restrict the set of values contained in the object returned by the getComputedStyle method, which allows remote attackers to obtain sensitive information about visited web pages by calling this...

6AI Score

0.003EPSS

2022-10-03 04:21 PM
24
cve
cve

CVE-2010-5227

Untrusted search path vulnerability in Opera before 10.62 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .htm, .mht, .mhtml, .xht, .xhtm, or .xhtl file. NOTE: some of these details are...

6.7AI Score

0.0004EPSS

2022-10-03 04:21 PM
26
cve
cve

CVE-2010-1310

Opera 10.50 allows remote attackers to obtain sensitive information via crafted XSLT constructs, which cause Opera to return cached contents of other...

6.3AI Score

0.002EPSS

2022-10-03 04:21 PM
23
cve
cve

CVE-2014-1870

Opera before 19 on Mac OS X allows user-assisted remote attackers to spoof the address bar via vectors involving a drag-and-drop...

6.7AI Score

0.001EPSS

2022-10-03 04:20 PM
19
cve
cve

CVE-2012-4143

Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, allows user-assisted remote attackers to trick users into downloading and executing arbitrary files via a small window for the download dialog, a different vulnerability than...

6.6AI Score

0.016EPSS

2022-10-03 04:15 PM
23
cve
cve

CVE-2012-4010

Opera before 11.60 allows remote attackers to spoof the address bar via unspecified homograph characters, a different vulnerability than...

6.5AI Score

0.008EPSS

2022-10-03 04:15 PM
19
cve
cve

CVE-2012-4145

Unspecified vulnerability in Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, has unknown impact and attack vectors, related to a "low severity...

6.3AI Score

0.002EPSS

2022-10-03 04:15 PM
29
cve
cve

CVE-2012-4144

Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, does not properly escape characters in DOM elements, which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted HTML...

5.4AI Score

0.004EPSS

2022-10-03 04:15 PM
24
cve
cve

CVE-2012-4146

Opera before 12.01 allows remote attackers to cause a denial of service (application crash) via a crafted web site, as demonstrated by the Lenovo "Shop now"...

6.3AI Score

0.004EPSS

2022-10-03 04:15 PM
26
4
cve
cve

CVE-2012-4142

Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, ignores some characters in HTML documents in unspecified circumstances, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted...

5.4AI Score

0.003EPSS

2022-10-03 04:15 PM
26
cve
cve

CVE-2012-5180

The Opera Mobile application before 12.1 and Opera Mini application before 7.5 for Android do not properly implement the WebView class, which allows attackers to obtain sensitive information via a crafted...

6.1AI Score

0.001EPSS

2022-10-03 04:15 PM
19
cve
cve

CVE-2012-6464

Cross-site scripting (XSS) vulnerability in Opera before 12.10 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript code that overrides methods of unspecified native objects in documents that have different...

5.7AI Score

0.001EPSS

2022-10-03 04:15 PM
18
cve
cve

CVE-2012-6472

Opera before 12.12 on UNIX uses weak permissions for the profile directory, which allows local users to obtain sensitive information by reading a (1) cache file, (2) password file, or (3) configuration file, or (4) possibly gain privileges by modifying or overwriting a configuration...

6.3AI Score

0.0004EPSS

2022-10-03 04:15 PM
18
cve
cve

CVE-2012-6462

Opera before 12.10 does not properly implement the Cross-Origin Resource Sharing (CORS) specification, which allows remote attackers to bypass intended page-content restrictions via a crafted...

6.4AI Score

0.001EPSS

2022-10-03 04:15 PM
21
4
cve
cve

CVE-2012-6460

Opera before 11.67 and 12.x before 12.02 allows remote attackers to cause truncation of a dialog, and possibly trigger downloading and execution of arbitrary programs, via a crafted web...

6.9AI Score

0.002EPSS

2022-10-03 04:15 PM
17
cve
cve

CVE-2012-6466

Opera before 12.10 does not properly handle incorrect size data in a WebP image, which allows remote attackers to obtain potentially sensitive information from process memory by using a crafted image as the fill pattern for a...

6AI Score

0.001EPSS

2022-10-03 04:15 PM
22
cve
cve

CVE-2012-6461

The X.509 certificate-validation functionality in the https implementation in Opera before 12.10 allows remote attackers to trigger a false indication of successful revocation-status checking by causing a failure of a single checking...

6.4AI Score

0.002EPSS

2022-10-03 04:15 PM
23
cve
cve

CVE-2012-6470

Opera before 12.12 does not properly allocate memory for GIF images, which allows remote attackers to execute arbitrary code or cause a denial of service (memory overwrite) via a malformed...

7.8AI Score

0.078EPSS

2022-10-03 04:15 PM
27
cve
cve

CVE-2012-6471

Opera before 12.12 allows remote attackers to spoof the address field via a high rate of HTTP...

6.4AI Score

0.001EPSS

2022-10-03 04:15 PM
25
cve
cve

CVE-2012-6465

Opera before 12.10 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a malformed SVG...

7.7AI Score

0.011EPSS

2022-10-03 04:15 PM
35
cve
cve

CVE-2012-6463

Cross-site scripting (XSS) vulnerability in Opera before 12.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an unspecified sequence of loading of documents and loading of data:...

5.6AI Score

0.001EPSS

2022-10-03 04:15 PM
22
cve
cve

CVE-2012-1251

Opera before 9.63 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

5.8AI Score

0.001EPSS

2022-10-03 04:15 PM
19
cve
cve

CVE-2012-3555

Opera before 11.65 does not ensure that keyboard sequences are associated with a visible window, which makes it easier for user-assisted remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary code via a crafted web site, related to a "hidden keyboard navigation"...

6.9AI Score

0.009EPSS

2022-10-03 04:15 PM
24
cve
cve

CVE-2012-3557

Opera before 11.65 does not properly restrict the reading of JSON strings, which allows remote attackers to perform cross-domain loading of JSON resources and consequently obtain sensitive information via a crafted web...

7.1AI Score

0.002EPSS

2022-10-03 04:15 PM
25
cve
cve

CVE-2012-3558

Opera before 11.65 does not ensure that the address field corresponds to the displayed web page during unusually timed changes to this field, which makes it easier for user-assisted remote attackers to conduct spoofing attacks via vectors involving navigation, reloads, and...

7.1AI Score

0.002EPSS

2022-10-03 04:15 PM
26
cve
cve

CVE-2012-3556

Opera before 11.65 does not properly restrict the opening of a pop-up window in response to the first click of a double-click action, which makes it easier for user-assisted remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary code via a crafted web...

6.9AI Score

0.01EPSS

2022-10-03 04:15 PM
32
cve
cve

CVE-2012-3560

Opera before 11.65 does not ensure that the address field corresponds to the displayed web page during blocked navigation, which makes it easier for remote attackers to conduct spoofing attacks by detecting and preventing attempts to load a different web...

7.2AI Score

0.002EPSS

2022-10-03 04:15 PM
24
cve
cve

CVE-2012-3559

Unspecified vulnerability in Opera before 12.00 on Mac OS X has unknown impact and attack vectors, related to a "moderate severity...

6.7AI Score

0.002EPSS

2022-10-03 04:15 PM
22
cve
cve

CVE-2011-2627

Unspecified vulnerability in the DOM implementation in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by...

7.1AI Score

0.004EPSS

2022-10-03 04:15 PM
26
cve
cve

CVE-2011-2629

Unspecified vulnerability in Opera before 11.11 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by...

7.2AI Score

0.004EPSS

2022-10-03 04:15 PM
25
Total number of security vulnerabilities324