Opera Browser
by Opera
CVEs (280)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2008-1081 | 0.00 | — | 0.03 | Feb 29, 2008 | Opera before 9.26 allows user-assisted remote attackers to execute arbitrary script via images that contain custom comments, which are treated as script when the user displays the image properties. | |||
| CVE-2008-1082 | 0.00 | — | 0.02 | Feb 29, 2008 | Opera before 9.26 allows remote attackers to "bypass sanitization filters" and conduct cross-site scripting (XSS) attacks via crafted attribute values in an XML document, which are not properly handled during DOM presentation. | |||
| CVE-2007-6521 | 0.00 | — | 0.05 | Dec 24, 2007 | Unspecified vulnerability in Opera before 9.25 allows remote attackers to execute arbitrary code via crafted TLS certificates. | |||
| CVE-2007-6524 | 0.00 | — | 0.02 | Dec 24, 2007 | Opera before 9.25 allows remote attackers to obtain potentially sensitive memory contents via a crafted bitmap (BMP) file, as demonstrated using a CANVAS element and JavaScript in an HTML document for copying these contents from 9.50 beta, a related issue to CVE-2008-0420. | |||
| CVE-2007-6520 | 0.00 | — | 0.02 | Dec 24, 2007 | Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks via unknown vectors related to plug-ins. | |||
| CVE-2007-6522 | 0.00 | — | 0.02 | Dec 24, 2007 | The rich text editing functionality in Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks by using designMode to modify contents of pages in other domains. | |||
| CVE-2007-6523 | 0.00 | — | 0.02 | Dec 24, 2007 | Algorithmic complexity vulnerability in Opera 9.50 beta and 9.x before 9.25 allows remote attackers to cause a denial of service (CPU consumption) via a crafted bitmap (BMP) file that triggers a large number of calculations and checks. | |||
| CVE-2007-5540 | 0.00 | — | 0.03 | Oct 18, 2007 | Unspecified vulnerability in Opera before 9.24 allows remote attackers to overwrite functions on pages from other domains and bypass the same-origin policy via unknown vectors. | |||
| CVE-2007-5541 | 0.00 | — | 0.05 | Oct 18, 2007 | Unspecified vulnerability in Opera before 9.24, when using an "external" newsgroup or e-mail client, allows remote attackers to execute arbitrary commands via unknown vectors. | |||
| CVE-2007-5276 | 0.00 | — | 0.01 | Oct 8, 2007 | Opera 9 drops DNS pins based on failed connections to irrelevant TCP ports, which makes it easier for remote attackers to conduct DNS rebinding attacks, as demonstrated by a port 81 URL in an IMG SRC, when the DNS pin had been established for a session on port 80. | |||
| CVE-2007-4944 | 0.00 | — | 0.02 | Sep 18, 2007 | The canvas.createPattern function in Opera 9.x before 9.22 for Linux, FreeBSD, and Solaris does not clear memory before using it to process a new pattern, which allows remote attackers to obtain sensitive information (memory contents) via JavaScript. | |||
| CVE-2007-3819 | 0.00 | — | 0.02 | Jul 17, 2007 | Opera 9.21 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed. | |||
| CVE-2007-3142 | 0.00 | — | 0.01 | Jun 11, 2007 | Visual truncation vulnerability in Opera 9.21 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a long hostname, which is truncated after 34 characters, as demonstrated by a phishing attack using HTTP Basic Authentication. | |||
| CVE-2007-2022 | 0.00 | — | 0.05 | Apr 13, 2007 | Adobe Macromedia Flash Player 7 and 9, when used with Opera before 9.20 or Konqueror before 20070613, allows remote attackers to obtain sensitive information (browser keystrokes), which are leaked to the Flash Player applet. | |||
| CVE-2007-1737 | 0.00 | — | 0.01 | Mar 28, 2007 | Opera 9.10 does not check URLs embedded in (1) object or (2) iframe HTML tags against the phishing site blacklist, which allows remote attackers to bypass phishing protection. | |||
| CVE-2007-1115 | 0.00 | — | 0.02 | Feb 26, 2007 | The child frames in Opera 9 before 9.20 inherit the default charset from the parent window when a charset is not specified in an HTTP Content-Type header or META tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7… | |||
| CVE-2007-0802 | 0.00 | — | 0.02 | Feb 7, 2007 | Mozilla Firefox 2.0.0.1 allows remote attackers to bypass the Phishing Protection mechanism by adding certain characters to the end of the domain name, as demonstrated by the "." and "/" characters, which is not caught by the Phishing List blacklist filter. | |||
| CVE-2006-6970 | 0.00 | — | 0.01 | Feb 7, 2007 | Opera 9.10 Final allows remote attackers to bypass the Fraud Protection mechanism by adding certain characters to the end of a domain name, as demonstrated by the "." and "/" characters, which is not caught by the blacklist filter. | |||
| CVE-2006-6955 | 0.00 | — | 0.01 | Jan 29, 2007 | Opera allows remote attackers to cause a denial of service (application crash) via a web page that contains a large number of nested marquee tags, a related issue to CVE-2006-2723. | |||
| CVE-2007-0127 | 0.00 | — | 0.05 | Jan 9, 2007 | The Javascript SVG support in Opera before 9.10 does not properly validate object types in a createSVGTransformFromMatrix request, which allows remote attackers to execute arbitrary code via JavaScript code that uses an invalid object in this request that causes a controlled… |
- CVE-2008-1081Feb 29, 2008risk 0.00cvss —epss 0.03
Opera before 9.26 allows user-assisted remote attackers to execute arbitrary script via images that contain custom comments, which are treated as script when the user displays the image properties.
- CVE-2008-1082Feb 29, 2008risk 0.00cvss —epss 0.02
Opera before 9.26 allows remote attackers to "bypass sanitization filters" and conduct cross-site scripting (XSS) attacks via crafted attribute values in an XML document, which are not properly handled during DOM presentation.
- CVE-2007-6521Dec 24, 2007risk 0.00cvss —epss 0.05
Unspecified vulnerability in Opera before 9.25 allows remote attackers to execute arbitrary code via crafted TLS certificates.
- CVE-2007-6524Dec 24, 2007risk 0.00cvss —epss 0.02
Opera before 9.25 allows remote attackers to obtain potentially sensitive memory contents via a crafted bitmap (BMP) file, as demonstrated using a CANVAS element and JavaScript in an HTML document for copying these contents from 9.50 beta, a related issue to CVE-2008-0420.
- CVE-2007-6520Dec 24, 2007risk 0.00cvss —epss 0.02
Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks via unknown vectors related to plug-ins.
- CVE-2007-6522Dec 24, 2007risk 0.00cvss —epss 0.02
The rich text editing functionality in Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks by using designMode to modify contents of pages in other domains.
- CVE-2007-6523Dec 24, 2007risk 0.00cvss —epss 0.02
Algorithmic complexity vulnerability in Opera 9.50 beta and 9.x before 9.25 allows remote attackers to cause a denial of service (CPU consumption) via a crafted bitmap (BMP) file that triggers a large number of calculations and checks.
- CVE-2007-5540Oct 18, 2007risk 0.00cvss —epss 0.03
Unspecified vulnerability in Opera before 9.24 allows remote attackers to overwrite functions on pages from other domains and bypass the same-origin policy via unknown vectors.
- CVE-2007-5541Oct 18, 2007risk 0.00cvss —epss 0.05
Unspecified vulnerability in Opera before 9.24, when using an "external" newsgroup or e-mail client, allows remote attackers to execute arbitrary commands via unknown vectors.
- CVE-2007-5276Oct 8, 2007risk 0.00cvss —epss 0.01
Opera 9 drops DNS pins based on failed connections to irrelevant TCP ports, which makes it easier for remote attackers to conduct DNS rebinding attacks, as demonstrated by a port 81 URL in an IMG SRC, when the DNS pin had been established for a session on port 80.
- CVE-2007-4944Sep 18, 2007risk 0.00cvss —epss 0.02
The canvas.createPattern function in Opera 9.x before 9.22 for Linux, FreeBSD, and Solaris does not clear memory before using it to process a new pattern, which allows remote attackers to obtain sensitive information (memory contents) via JavaScript.
- CVE-2007-3819Jul 17, 2007risk 0.00cvss —epss 0.02
Opera 9.21 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed.
- CVE-2007-3142Jun 11, 2007risk 0.00cvss —epss 0.01
Visual truncation vulnerability in Opera 9.21 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a long hostname, which is truncated after 34 characters, as demonstrated by a phishing attack using HTTP Basic Authentication.
- CVE-2007-2022Apr 13, 2007risk 0.00cvss —epss 0.05
Adobe Macromedia Flash Player 7 and 9, when used with Opera before 9.20 or Konqueror before 20070613, allows remote attackers to obtain sensitive information (browser keystrokes), which are leaked to the Flash Player applet.
- CVE-2007-1737Mar 28, 2007risk 0.00cvss —epss 0.01
Opera 9.10 does not check URLs embedded in (1) object or (2) iframe HTML tags against the phishing site blacklist, which allows remote attackers to bypass phishing protection.
- CVE-2007-1115Feb 26, 2007risk 0.00cvss —epss 0.02
The child frames in Opera 9 before 9.20 inherit the default charset from the parent window when a charset is not specified in an HTTP Content-Type header or META tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7…
- CVE-2007-0802Feb 7, 2007risk 0.00cvss —epss 0.02
Mozilla Firefox 2.0.0.1 allows remote attackers to bypass the Phishing Protection mechanism by adding certain characters to the end of the domain name, as demonstrated by the "." and "/" characters, which is not caught by the Phishing List blacklist filter.
- CVE-2006-6970Feb 7, 2007risk 0.00cvss —epss 0.01
Opera 9.10 Final allows remote attackers to bypass the Fraud Protection mechanism by adding certain characters to the end of a domain name, as demonstrated by the "." and "/" characters, which is not caught by the blacklist filter.
- CVE-2006-6955Jan 29, 2007risk 0.00cvss —epss 0.01
Opera allows remote attackers to cause a denial of service (application crash) via a web page that contains a large number of nested marquee tags, a related issue to CVE-2006-2723.
- CVE-2007-0127Jan 9, 2007risk 0.00cvss —epss 0.05
The Javascript SVG support in Opera before 9.10 does not properly validate object types in a createSVGTransformFromMatrix request, which allows remote attackers to execute arbitrary code via JavaScript code that uses an invalid object in this request that causes a controlled…
Page 12 of 14