Lucene search

K
OperaOpera Browser8.53

171 matches found

CVE
CVE
added 2009/06/15 7:30 p.m.46 views

CVE-2009-2063

Opera, possibly before 9.25, processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.

6.8CVSS7.4AI score0.00269EPSS
CVE
CVE
added 2010/07/08 12:54 p.m.46 views

CVE-2010-2662

Opera before 10.60 allows remote attackers to bypass the popup blocker via a javascript: URL and a "fake click."

4.3CVSS7.3AI score0.00246EPSS
CVE
CVE
added 2010/12/22 3:0 a.m.46 views

CVE-2010-4579

Opera before 11.00 does not properly constrain dialogs to appear on top of rendered documents, which makes it easier for remote attackers to trick users into interacting with a crafted web site that spoofs the (1) security information dialog or (2) download dialog.

5CVSS7.2AI score0.00701EPSS
CVE
CVE
added 2011/01/31 9:0 p.m.46 views

CVE-2011-0681

The Cascading Style Sheets (CSS) Extensions for XML implementation in Opera before 11.01 recognizes links to javascript: URLs in the -o-link property, which makes it easier for remote attackers to bypass CSS filtering via a crafted URL.

4.3CVSS7.1AI score0.00288EPSS
CVE
CVE
added 2011/07/01 10:55 a.m.46 views

CVE-2011-2609

Opera before 11.50 does not properly restrict data: URIs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site.

4.3CVSS6.7AI score0.00513EPSS
CVE
CVE
added 2011/07/01 10:55 a.m.46 views

CVE-2011-2614

The SVG implementation in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via vectors involving a path on which many characters are drawn.

5CVSS7.1AI score0.00535EPSS
CVE
CVE
added 2011/07/01 10:55 a.m.46 views

CVE-2011-2624

Opera before 11.50 allows user-assisted remote attackers to cause a denial of service (application hang) via a large table, which is not properly handled during a print preview.

4.3CVSS7.1AI score0.005EPSS
CVE
CVE
added 2011/12/07 7:55 p.m.46 views

CVE-2011-4681

Opera before 11.60 does not properly consider the number of . (dot) characters that conventionally exist in domain names of different top-level domains, which allows remote attackers to bypass the Same Origin Policy by leveraging access to a different domain name in the same top-level domain, as de...

5CVSS7.3AI score0.0022EPSS
CVE
CVE
added 2013/01/02 11:46 a.m.46 views

CVE-2012-6469

Opera before 12.11 allows remote attackers to determine the existence of arbitrary local files via vectors involving web script in an error page.

5CVSS6.3AI score0.0026EPSS
CVE
CVE
added 2007/01/09 2:28 a.m.45 views

CVE-2007-0127

The Javascript SVG support in Opera before 9.10 does not properly validate object types in a createSVGTransformFromMatrix request, which allows remote attackers to execute arbitrary code via JavaScript code that uses an invalid object in this request that causes a controlled pointer to be reference...

9.3CVSS7.2AI score0.09725EPSS
CVE
CVE
added 2008/12/19 4:30 p.m.45 views

CVE-2008-5682

Cross-site scripting (XSS) vulnerability in Opera before 9.63 allows remote attackers to inject arbitrary web script or HTML via built-in XSLT templates.

4.3CVSS5.5AI score0.00475EPSS
CVE
CVE
added 2009/06/15 7:30 p.m.45 views

CVE-2009-2059

Opera, possibly before 9.25, uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" at...

6.8CVSS7.3AI score0.00235EPSS
CVE
CVE
added 2010/06/22 5:30 p.m.45 views

CVE-2010-2421

Multiple unspecified vulnerabilities in Opera before 10.54 have unknown impact and attack vectors related to (1) "extremely severe," (2) "highly severe," (3) "moderately severe," and (4) "less severe" issues.

10CVSS7.4AI score0.0147EPSS
CVE
CVE
added 2010/07/08 12:54 p.m.45 views

CVE-2010-2663

Opera before 10.60 allows remote attackers to cause a denial of service (application hang) via an ended event handler that changes the SRC attribute of an AUDIO element.

4.3CVSS7.2AI score0.00686EPSS
CVE
CVE
added 2010/10/21 7:0 p.m.45 views

CVE-2010-4046

Opera before 10.63 does not properly verify the origin of video content, which allows remote attackers to obtain sensitive information by using a video stream as HTML5 canvas content.

4.3CVSS6.1AI score0.00777EPSS
CVE
CVE
added 2010/12/22 3:0 a.m.45 views

CVE-2010-4583

Opera before 11.00, when Opera Turbo is enabled, does not display a page's security indication, which makes it easier for remote attackers to spoof trusted content via a crafted web site.

2.6CVSS7.1AI score0.00329EPSS
CVE
CVE
added 2011/07/01 10:55 a.m.45 views

CVE-2011-2616

Unspecified vulnerability in Opera before 11.50 allows remote attackers to cause a denial of service (memory consumption) via unknown content on a web page, as demonstrated by test262.ecmascript.org.

5CVSS7.1AI score0.00492EPSS
CVE
CVE
added 2011/07/01 10:55 a.m.45 views

CVE-2011-2622

Unspecified vulnerability in the Web Workers implementation in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via unknown vectors.

5CVSS7.1AI score0.00492EPSS
CVE
CVE
added 2011/07/01 10:55 a.m.45 views

CVE-2011-2627

Unspecified vulnerability in the DOM implementation in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by live.com.

5CVSS7.1AI score0.00492EPSS
CVE
CVE
added 2011/12/07 7:55 p.m.45 views

CVE-2011-4686

Unspecified vulnerability in the Web Workers implementation in Opera before 11.60 allows remote attackers to cause a denial of service (application crash) via unknown vectors.

5CVSS6.4AI score0.00756EPSS
CVE
CVE
added 2012/02/07 4:9 a.m.45 views

CVE-2012-1003

Multiple integer overflows in Opera 11.60 and earlier allow remote attackers to cause a denial of service (application crash) via a large integer argument to the (1) Int32Array, (2) Float32Array, (3) Float64Array, (4) Uint32Array, (5) Int16Array, or (6) ArrayBuffer function. NOTE: the vendor report...

5CVSS6.7AI score0.00481EPSS
CVE
CVE
added 2012/06/14 7:55 p.m.45 views

CVE-2012-3568

Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via crafted WebGL content, as demonstrated by a codeflow.org WebGL demo.

5CVSS6.5AI score0.00436EPSS
CVE
CVE
added 2012/08/06 4:55 p.m.45 views

CVE-2012-4146

Opera before 12.01 allows remote attackers to cause a denial of service (application crash) via a crafted web site, as demonstrated by the Lenovo "Shop now" page.

4.3CVSS6.3AI score0.00461EPSS
CVE
CVE
added 2009/09/18 10:30 p.m.44 views

CVE-2008-7245

Opera 9.52 and earlier allows remote attackers to cause a denial of service (unusable browser) by calling the window.print function in a loop, aka a "printing DoS attack," possibly a related issue to CVE-2009-0821.

5CVSS6.5AI score0.02598EPSS
CVE
CVE
added 2009/11/24 5:30 p.m.44 views

CVE-2009-4072

Unspecified vulnerability in Opera before 10.10 has unknown impact and attack vectors, related to a "moderately severe issue."

10CVSS7.3AI score0.01394EPSS
CVE
CVE
added 2010/08/16 6:39 p.m.44 views

CVE-2010-3020

The news-feed preview feature in Opera before 10.61 does not properly remove scripts, which allows remote attackers to force subscriptions to arbitrary feeds via crafted content.

5CVSS7.3AI score0.00435EPSS
CVE
CVE
added 2010/12/22 3:0 a.m.44 views

CVE-2010-4585

Unspecified vulnerability in the auto-update functionality in Opera before 11.00 allows remote attackers to cause a denial of service (application crash) by triggering an Opera Unite update.

5CVSS7.1AI score0.00887EPSS
CVE
CVE
added 2011/01/31 9:0 p.m.44 views

CVE-2011-0682

Integer truncation error in opera.dll in Opera before 11.01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTML form with a select element that contains a large number of children.

9.3CVSS7.8AI score0.11628EPSS
CVE
CVE
added 2011/07/01 10:55 a.m.44 views

CVE-2011-2628

Opera before 11.11 does not properly implement FRAMESET elements, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to page unload.

10CVSS7.8AI score0.28276EPSS
CVE
CVE
added 2011/07/01 10:55 a.m.44 views

CVE-2011-2629

Unspecified vulnerability in Opera before 11.11 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by www.falk.de.

5CVSS7.2AI score0.00492EPSS
CVE
CVE
added 2011/07/01 10:55 a.m.44 views

CVE-2011-2638

Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by games on zylom.com.

5CVSS7.2AI score0.00492EPSS
CVE
CVE
added 2011/09/06 7:55 p.m.44 views

CVE-2011-3388

Opera before 11.51 allows remote attackers to cause an insecure site to appear secure or trusted via unspecified actions related to Extended Validation and loading content from trusted sources in an unspecified sequence that causes the address field and page information dialog to contain security i...

4.3CVSS7.2AI score0.01018EPSS
CVE
CVE
added 2011/12/07 7:55 p.m.44 views

CVE-2011-4683

Unspecified vulnerability in Opera before 11.60 has unknown impact and attack vectors, related to a "moderately severe issue."

10CVSS7.2AI score0.00539EPSS
CVE
CVE
added 2012/03/28 3:22 a.m.44 views

CVE-2012-1928

Opera before 11.62 allows remote attackers to spoof the address field by triggering a page reload followed by a redirect to a different domain.

6.4CVSS7.2AI score0.01662EPSS
CVE
CVE
added 2012/06/14 7:55 p.m.44 views

CVE-2012-3558

Opera before 11.65 does not ensure that the address field corresponds to the displayed web page during unusually timed changes to this field, which makes it easier for user-assisted remote attackers to conduct spoofing attacks via vectors involving navigation, reloads, and redirects.

2.6CVSS7.1AI score0.00339EPSS
CVE
CVE
added 2009/07/22 6:30 p.m.43 views

CVE-2009-2577

Opera 9.52 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption, and application hang) via a long Unicode string argument to the write method, a related issue to CVE-2009-2479.

5CVSS6.5AI score0.14161EPSS
CVE
CVE
added 2010/06/25 7:30 p.m.43 views

CVE-2010-2455

Opera does not properly manage the address bar between the request to open a URL and the retrieval of the new document's content, which might allow remote attackers to conduct spoofing attacks via a crafted HTML document, a related issue to CVE-2010-1206.

4.3CVSS7.3AI score0.00477EPSS
CVE
CVE
added 2010/07/08 12:54 p.m.43 views

CVE-2010-2666

Opera before 10.54 on Windows and Mac OS X does not properly enforce permission requirements for widget filesystem access and directory selection, which allows user-assisted remote attackers to create or modify arbitrary files, and consequently execute arbitrary code, via widget File I/O operations...

9.3CVSS7.5AI score0.04056EPSS
CVE
CVE
added 2011/07/01 10:55 a.m.43 views

CVE-2011-1337

Opera before 11.50 allows remote attackers to cause a denial of service (disk consumption) via invalid URLs that trigger creation of error pages.

4.3CVSS7.2AI score0.02017EPSS
CVE
CVE
added 2011/07/01 10:55 a.m.43 views

CVE-2011-2610

Unspecified vulnerability in Opera before 11.50 has unknown impact and attack vectors, related to a "moderately severe issue."

10CVSS7.2AI score0.00533EPSS
CVE
CVE
added 2011/07/01 10:55 a.m.43 views

CVE-2011-2612

Unspecified vulnerability in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by progorod.ru.

5CVSS7.2AI score0.00492EPSS
CVE
CVE
added 2011/07/01 10:55 a.m.43 views

CVE-2011-2615

Unspecified vulnerability in Opera before 11.50 allows remote attackers to cause a denial of service (application hang) via unknown content on a web page, as demonstrated by domiteca.com.

5CVSS7.1AI score0.00492EPSS
CVE
CVE
added 2012/08/30 5:55 p.m.43 views

CVE-2012-4010

Opera before 11.60 allows remote attackers to spoof the address bar via unspecified homograph characters, a different vulnerability than CVE-2010-2660.

5CVSS6.5AI score0.01003EPSS
CVE
CVE
added 2013/09/13 2:10 p.m.43 views

CVE-2013-4705

Cross-site scripting (XSS) vulnerability in Opera before 15.00 allows remote attackers to inject arbitrary web script or HTML by leveraging UTF-8 encoding.

4.3CVSS5.8AI score0.00254EPSS
CVE
CVE
added 2008/09/27 10:30 a.m.42 views

CVE-2008-4198

Opera before 9.52, when rendering an http page that has loaded an https page into a frame, displays a padlock icon and offers a security information dialog reporting a secure connection, which might allow remote attackers to trick a user into performing unsafe actions on the http page.

5CVSS8.5AI score0.00957EPSS
CVE
CVE
added 2009/09/18 10:30 p.m.42 views

CVE-2009-3266

Opera before 10.01 does not properly restrict HTML in a (1) RSS or (2) Atom feed, which allows remote attackers to conduct cross-site scripting (XSS) attacks, and conduct cross-zone scripting attacks involving the Feed Subscription Page to read feeds or create feed subscriptions, via a crafted feed...

4.3CVSS5.4AI score0.00795EPSS
CVE
CVE
added 2010/07/08 12:54 p.m.42 views

CVE-2010-2664

Opera before 10.60 allows remote attackers to cause a denial of service (application hang) via certain HTML content that has an unclosed SPAN element with absolute positioning.

4.3CVSS7.2AI score0.00686EPSS
CVE
CVE
added 2011/01/31 9:0 p.m.42 views

CVE-2011-0685

The Delete Private Data feature in Opera before 11.01 does not properly implement the "Clear all email account passwords" option, which might allow physically proximate attackers to access an e-mail account via an unattended workstation.

2.1CVSS7.2AI score0.0007EPSS
CVE
CVE
added 2011/07/01 10:55 a.m.42 views

CVE-2011-2620

Unspecified vulnerability in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via vectors involving SVG animation.

5CVSS7AI score0.00535EPSS
CVE
CVE
added 2011/07/01 10:55 a.m.42 views

CVE-2011-2634

Opera before 11.10 allows remote attackers to hijack (1) searches and (2) customizations via unspecified third party applications.

5CVSS7.3AI score0.00274EPSS
Total number of security vulnerabilities171