CVE-2007-4367

CVE-2007-4367 affects Opera prior to 9.23 due to a flaw in the JavaScript engine that can trigger a “virtual function call on an invalid pointer.” This allows remote arbitrary code execution. Documents reference Opera updates/patches (Opera 9.23+), e.g., SUSE/Gentoo advisories and OpenVAS/Nessus ...

CVE-2007-6522

Opera prior to version 9.25 contains CVE-2007-6522 where rich text editing via designMode can be abused to perform cross-domain scripting. The vulnerability’s impact is described as enabling cross-site scripting by modifying contents in pages on other domains, with associated risk of information ...

CVE-2008-5681

Opera before 9.63 is affected by CVE-2008-5681: the feed preview does not block unspecified scripted URLs, allowing a remote attacker to read existing subscriptions and force subscriptions to arbitrary feed URLs. Gentoo GLSA 200903-30/Opera advisories recommend upgrading to Opera 9.64 or later as...

CVE-2009-3045

Opera before 10.00 trusts root X.509 certificates signed with MD2, enabling MITM with a crafted server certificate and spoofing of SSL servers. Affected component is the browser’s certificate handling; the root cause is acceptance of MD2-signed certificates, which undermines TLS trust. In practic...

CVE-2009-3048

Opera before 10.00 on Linux, Solaris, and FreeBSD is vulnerable due to improper handling of INPUT TYPE=file, enabling a remote attacker to trick a user into uploading an unintended file via a dropped-file vector. The issue is documented in CVE-2009-3048 and is echoed across multiple feeds (NVD en...

CVE-2009-3265

Opera 9.x/10.x is affected by CVE-2009-3265, a Cross-site scripting (XSS) flaw where rendering of RSS/Atom feeds as scripted content enables injection of arbitrary script/HTML. The underlying issue is the handling of application/rss+xml as scripted content. The vendor reportedly viewed this as a ...

CVE-2010-2455

Technical details for CVE-2010-2455 are not provided in the supplied documents. The connected Nessus/OpenSUSE advisories reference other CVEs (1205-1215, etc.) but do not elaborate on this specific Opera spoofing issue. Monitor for updates.

CVE-2010-2666

CVE-2010-2666 affects Opera Browser

CVE-2010-4586

The CVE-2010-4586 issue concerns Opera before 11.00, where WebSockets functionality is enabled by default. The description indicates an unspecified impact and remote attack vectors, and notes a possible relation to CVE-2010-4508. Connected sources confirm that Opera 11.00 includes fixes, implying...

CVE-2010-5072

Opera 10.5 JavaScript getComputedStyle implementation is vulnerable to information disclosure. The vulnerability arises because the set of values returned by getComputedStyle is not properly restricted, allowing an attacker to remotely obtain sensitive information about visited web pages. This af...

CVE-2011-0684

The connected sources confirm CVE-2011-0684 affects Opera prior to 11.01, where improper handling of redirections and certain HTTP responses could allow a remote server to access local files and exfiltrate their contents via local resources. The issue is tied to input validation in redirection ha...

CVE-2011-1824

CVE-2011-1824 affects Opera versions older than 10.61. The vulnerability arises in VEGAOpBitmap::AddLine when processing a SELECT element’s SIZE attribute, causing an uninitialized memory write that can crash the application or potentially allow arbitrary code execution. Exploitation involves lar...

CVE-2012-1925

CVE-2012-1925 affects Opera before 11.62. The dialog window stacking order could fail to stay on top of content windows, enabling a user‑assisted remote attacker to trick users into downloading and executing arbitrary files via a download dialog that is placed under other windows. Affected produc...

CVE-2012-3562

CVE-2012-3562 affects Opera before 12.00 Beta. The vulnerability arises from improper handling of a crafted web page during a reload, enabling a user‑assisted remote attacker to cause an application crash (DoS). The NVD description confirms the attacker requires user action and the impact is deni...

CVE-2003-0593

CVE-2003-0593 describes a vulnerability in Opera where remote attackers can bypass cookie access restrictions by using encoded directory traversal sequences (%2e%2e) in a URL. This leads Opera to send cookies outside the intended URL subset to a potentially co-located application on the same serv...

CVE-2004-0537

Opera 7.50 and earlier is vulnerable to address bar spoofing via the favicon feature. The weakness allows remote web pages to provide a favicon that is wider than expected, enabling spoofing of the apparent domain and facilitating phishing using a wide icon and added spaces. Concrete details acro...

CVE-2005-1139

Opera 8 Beta 3 could display the Organizational information of SSL certificates using first-generation vetted certs, enabling spoofing and phishing attacks. The issue is addressed in Opera’s 8.0 update per SUSE-SA:2005:031 advisory; remediation is to upgrade to Opera 8.0+ (or later) where this is...

CVE-2005-2273

Vulnerability summary: Opera 7.x and 8 before 8.01 contain a dialog origin spoofing issue where a Javascript dialog box is not clearly associated with the generating page, allowing remote attackers to spoof a dialog from a trusted site and facilitate phishing. Notes: The connected documents descr...

CVE-2007-2274

CVE-2007-2274 describes a DoS in Opera’s BitTorrent implementation (Opera 9.2) triggered by a malformed torrent file, with original disclosures mentioning a memory leak but uncertainty remains. Connected sources also reference related Opera issues: CVE-2007-2809 describes a buffer overflow in Ope...

CVE-2008-2715

Summary: CVE-2008-2715 is an unspecified vulnerability in Opera prior to 9.5 that could allow remote attackers to read cross-domain images via HTML CANVAS elements that use the images as patterns. This vulnerability is reflected in multiple advisories (SUSE/OpenSUSE patches; NVD entry) and is add...

CVE-2009-2059

Opera, possibly before 9.25, is affected by an SSL-tampering vulnerability where the HTTP Host header is used to determine the context of a document in certain 4xx/5xx CONNECT responses from a proxy. This enables a man-in-the-middle to inject arbitrary web script by modifying the CONNECT response...

CVE-2010-5068

Opera 10.5 is reported to mishandle the :visited CSS pseudo-class, enabling potential information disclosure of visited pages. The CVE-2010-5068 entry documents this issue with MEDIUM severity (CVSS v2 base score 4.3). OpenVAS/OpenVAS-derived entries also reference multiple information-disclosure...

CVE-2011-0681

CVE-2011-0681 affects Opera before 11.01. The CSS Extensions for XML implementation recognizes javascript: URLs in the -o-link property, enabling bypass of CSS filtering. Opera 11.01 fixes this by upgrading. The connected documents confirm the specific mechanism and the fixed version; exploitatio...

CVE-2011-2637

Opera browser, prior to version 11.10, contains an unspecified vulnerability that can trigger a remote denial-of-service via crafted web content. This CVE (CVE-2011-2637) is referenced across multiple advisories (e.g., Red Hat, SUSE, Gentoo GLSA-201206-03) and OpenVAS plugins. The publicly stated...

CVE-2011-4687

CVE-2011-4687 affects Opera before 11.60. The issue is a remote denial-of-service vulnerability caused by processing unspecified content on a web page (demonstrated via a Cisco homepage page), leading to CPU and memory consumption. Public documents identify Opera 11.60 as the fixed version; OpenV...

CVE-2012-3560

CVE-2012-3560 affects Opera before 11.65. The issue is that the address bar may not correspond to the displayed page during blocked navigation, enabling remote spoofing attacks. Connected sources (Red Hat advisory, Opera changelogs) confirm the vulnerability in Opera prior to 11.65 and indicate t...

CVE-2012-6468

CVE-2012-6468 is described in the initial document as a heap-based buffer overflow in Opera (pre-12.11) that could be triggered by a long HTTP response, allowing remote code execution or memory corruption. Connected openvas entries corroborate multiple Opera vulnerabilities around the same period...

CVE-2013-1637

Opera pre-12.13 is vulnerable to remote code execution via DOM event vectors (CVE-2013-1637). Connected sources (SUSE GLSA 201406-14 and OpenVAS entries) confirm affected package: Opera with vulnerabilities described as multiple DOM-event related flaws enabling arbitrary code execution. The OpenV...

CVE-2003-1387

CVE-2003-1387 : A buffer overflow in Opera 6.05 and 6.06 (and possibly other versions) can be triggered by a URL containing a long username, allowing a remote attacker to potentially execute arbitrary code. The connected NVD entry confirms the vulnerability details but does not specify a patch ve...

CVE-2004-1490

CVE-2004-1490 affects Opera 7.54 and earlier. The issue: remote attackers can spoof file types shown in the download dialog by manipulating the Content-Disposition or Content-Type headers using dots and non-breaking spaces (ASCII 160). Impact described in sources includes confusion or verificatio...

CVE-2005-1475

The CVE-2005-1475 issue affects Opera 8.0 Final Build 1095 where the XMLHttpRequest object could bypass same-origin restrictions due to insufficient validation of server-side redirects, allowing a remote attacker to access resources on other domains and perform actions with the user’s privileges....

CVE-2007-0127

CVE-2007-0127 affects Opera before 9.10, where the Javascript SVG support fails to validate object types in a createSVGTransformFromMatrix request. This can allow remote attackers to execute arbitrary code via JavaScript that uses an invalid object, causing a controlled pointer to be referenced d...

CVE-2007-3142

CVE-2007-3142 affects Opera 9.21, where a visual truncation of a long hostname can spoof the address bar and enable phishing (demonstrated via HTTP Basic Authentication). The Gentoo GLSA advisory recommends upgrading to Opera ≥ 9.23 to resolve the issue. No exploit details are provided beyond the...

CVE-2008-4694

CVE-2008-4694 affects Opera prior to 9.60. The vulnerability arises from a crafted redirect URL that can cause the browser to crash (DoS) or allow remote code execution. Public sources in the connected docs corroborate that Opera 9.60 and earlier are impacted and note additional related issues (C...

CVE-2008-5680

CVE-2008-5680 corresponds to multiple buffer overflow vulnerabilities in Opera before 9.63. Specifically, insecure handling in (1) text-area processing and (2) long host names in file:// URLs could allow remote code execution. The combined impact is high: a remote attacker could trigger arbitrary...

CVE-2009-2577

CVE-2009-2577 is an Opera Unicode String Denial of Service vulnerability affecting Opera 9.52 and earlier. The issue allows a remote attacker to trigger a Denial of Service by supplying a long Unicode string argument to the write method, leading to CPU/memory consumption and an application hang. ...

CVE-2010-2121

Opera 9.52 is vulnerable to remote denial of service through JavaScript that loops infinitely to create IFRAMEs for invalid news:// or nntp:// URIs. The issue is a resource consumption DoS; no exploit details are provided in the connected materials. No remediation is specified in the supplied doc...

CVE-2010-4046

CVE-2010-4046 affects Opera browsers prior to 10.63. The vulnerability stems from Opera’s insufficient verification of video content origins, enabling a remote attacker to cause a video stream to be used as HTML5 canvas content and potentially reveal sensitive information. The issue is documented...

CVE-2010-4583

CVE-2010-4583 affects Opera prior to 11.00. When Opera Turbo is enabled, the browser may fail to display a page’s security indicator, enabling spoofing of trusted content via a crafted site. This vulnerability is addressed by upgrading Opera to a newer version (e.g., Opera 12.00.1467 or later as ...

CVE-2011-0450

Opera before 11.01 on Windows is affected by CVE-2011-0450 due to the downloads manager failing to correctly determine the pathname of the filesystem-viewing application. This can allow a user-assisted remote attacker to execute arbitrary code via a crafted web site that hosts an executable file....

CVE-2011-2612

CVE-2011-2612: A denial-of-service vulnerability in Opera browser affecting versions before 11.50, triggered by processing unspecified content on a web page (demonstrated via progorod.ru). Public records (RH/SUSE/Gentoo advisories and OpenVAS notes) corroborate that Opera 11.50 fixed multiple sec...

CVE-2011-2614

CVE-2011-2614 affects the SVG rendering in Opera prior to 11.50. The vulnerability allows a remote attacker to cause an application crash (DoS) by crafting a path with many drawn characters. Exploitation details are not provided in the sources; no in‑the‑wild exploit information is included. Reme...

CVE-2011-2631

The CVE-2011-2631 entry concerns Opera's CSS column-count handling in Opera prior to 11.11, which can cause a denial of service (infinite repaint loop leading to an app hang) when processing a crafted page. Connected sources confirm Opera as the affected product and indicate the root cause is imp...

CVE-2011-3388

The CVE-2011-3388 issue affects Opera before 11.51, where Extended Validation/trusted sources handling could cause the address bar and page information dialog to display security info from a trusted site for an insecure site, potentially misleading users. This is an information-disclosure/trust-d...

CVE-2006-3331

Opera before 9.0 contains a vulnerability where the SSL security bar is not reset after a download dialog from an SSL-enabled site, allowing remote attackers to spoof a trusted SSL certificate from an untrusted site and enabling phishing attacks. The available connected documents confirm the affe...

CVE-2007-2809

CVE-2007-2809 refers to a buffer overflow in Opera’s transfer manager for Windows prior to version 9.21. An attacker could trigger arbitrary code execution by supplying a crafted torrent file, with exploitation described as user-assisted and requiring the user to interact with the torrent entry (...

CVE-2010-2665

CVE-2010-2665 is an XSS vulnerability in Opera tracked across multiple sources. Affected software includes Opera before 10.54 on Windows and macOS, and before 10.11 on UNIX. The vulnerability allows remote attackers to inject arbitrary web script or HTML via a data: URI, related to incorrect dete...

CVE-2011-2617

Technical details for CVE-2011-2617 are not publicly provided in the supplied documents; the materials only reiterate an unspecified denial-of-service vulnerability in Opera before 11.50. Monitor for updates.

CVE-2011-4682

CVE-2011-4682 corresponds to an Opera JavaScript engine issue where the in operator is not correctly implemented, allowing remote attackers to bypass the Same Origin Policy via cross-site variable vectors. The vulnerability affects Opera releases prior to 11.60, with exploitation leading to poten...

CVE-2011-4685

CVE-2011-4685 affects Opera prior to version 11.60. The issue allows remote attackers to cause a denial of service (application crash) via content on a web page (e.g., Forbes demonstrates). Affected software: Opera before 11.60. Root cause details are not elaborated in the provided text beyond th...