CVE-2018-16135 | Medium | 6.5 | 2022-12-26 | The Opera Mini application 47.1.2249.129326 for Android allows remote attackers to spoof the Location Permission dialog via a crafted web site. |
CVE-2021-23253 | Medium | 5.3 | 2021-01-11 | Opera Mini for Android below 53.1 displays URL left-aligned in the address field. This allows a malicious attacker to craft a URL with a long domain name, e.g… |
CVE-2020-6159 | Medium | 6.1 | 2020-12-23 | URLs using “javascript:” have the protocol removed when pasted into the address bar to protect users from cross-site scripting (XSS) attacks, but in certain ci… |
CVE-2020-6157 | Medium | 4.3 | 2020-11-13 | Opera Touch for iOS before version 2.4.5 is vulnerable to an address bar spoofing attack. The vulnerability allows a malicious page to trick the browser into s… |
CVE-2019-12278 | Medium | 4.3 | 2020-03-12 | Opera through 53 on Android allows Address Bar Spoofing. Characters from several languages are displayed in Right-to-Left order, due to mishandling of several… |
CVE-2019-19788 | Medium | 5.5 | 2019-12-18 | Opera for Android before 54.0.2669.49432 is vulnerable to a sandboxed cross-origin iframe bypass attack. By using a service working inside a sandboxed iframe i… |
CVE-2019-18624 | Critical | 9.8 | 2019-10-29 | Opera Mini for Android allows attackers to bypass intended restrictions on .apk file download/installation via an RTLO (aka Right to Left Override) approach, a… |
CVE-2019-13607 | Medium | 6.1 | 2019-07-18 | The Opera Mini application through 16.0.14 for iOS has a UXSS vulnerability that can be triggered by performing navigation to a javascript: URL. |
CVE-2018-18913 | High | 7.8 | 2019-03-21 | Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP archive composed of an HTML page along with a… |
CVE-2018-6608 | Medium | 4.3 | 2018-03-28 | In the WebRTC component in Opera 51.0.2830.55, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com)… |
CVE-2016-4075 | Medium | 6.1 | 2017-04-21 | Opera Mini 13 and Opera Stable 36 allow remote attackers to spoof the displayed URL via a crafted HTML document, related to the about:blank URL. |
CVE-2016-6908 | Medium | 6.1 | 2017-01-26 | Characters from languages are such as Arabic, Hebrew are displayed from RTL (Right To Left) order in Opera 37.0.2192.105088 for Android, due to mishandling of… |
CVE-2015-8960 | High | 8.1 | 2016-09-21 | The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not di… |
CVE-2016-7153 | Medium | 5.3 | 2016-09-06 | The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote att… |
CVE-2016-7152 | Medium | 5.3 | 2016-09-06 | The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote atta… |
CVE-2016-5101 | High | 8.8 | 2016-06-29 | Unspecified vulnerability in Opera Mail before 2016-02-16 on Windows allows user-assisted remote attackers to execute arbitrary code via a crafted e-mail messa… |
CVE-2015-4000 | Low | 3.7 | 2015-05-21 | The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which… |
CVE-2014-1870 | | | 2014-02-06 | Opera before 19 on Mac OS X allows user-assisted remote attackers to spoof the address bar via vectors involving a drag-and-drop operation. |
CVE-2014-0815 | | | 2014-02-06 | The intent: URL implementation in Opera before 18 on Android allows attackers to read local files by leveraging an interaction error, as demonstrated by readin… |
CVE-2013-4705 | | | 2013-09-13 | Cross-site scripting (XSS) vulnerability in Opera before 15.00 allows remote attackers to inject arbitrary web script or HTML by leveraging UTF-8 encoding. |
CVE-2013-3211 | | | 2013-04-19 | Unspecified vulnerability in Opera before 12.15 has unknown impact and attack vectors, related to a "moderately severe issue." |
CVE-2013-3210 | | | 2013-04-19 | Opera before 12.15 does not properly block top-level domains in Set-Cookie headers, which allows remote attackers to obtain sensitive information by leveraging… |
CVE-2013-1618 | | | 2013-02-08 | The TLS implementation in Opera before 12.13 does not properly consider timing side-channel attacks on a MAC check operation during the processing of malformed… |
CVE-2013-1639 | | | 2013-02-08 | Opera before 12.13 does not send CORS preflight requests in all required cases, which allows remote attackers to bypass a CSRF protection mechanism via a craft… |
CVE-2013-1638 | | | 2013-02-08 | Opera before 12.13 allows remote attackers to execute arbitrary code via crafted clipPaths in an SVG document. |
CVE-2013-1637 | | | 2013-02-08 | Opera before 12.13 allows remote attackers to execute arbitrary code via vectors involving DOM events. |
CVE-2013-1489 | | | 2013-01-31 | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 10 and Update 11, when running on Windows using Internet E… |
CVE-2012-6472 | | | 2013-01-02 | Opera before 12.12 on UNIX uses weak permissions for the profile directory, which allows local users to obtain sensitive information by reading a (1) cache fil… |
CVE-2012-6471 | | | 2013-01-02 | Opera before 12.12 allows remote attackers to spoof the address field via a high rate of HTTP requests. |
CVE-2012-6470 | | | 2013-01-02 | Opera before 12.12 does not properly allocate memory for GIF images, which allows remote attackers to execute arbitrary code or cause a denial of service (memo… |
CVE-2012-6469 | | | 2013-01-02 | Opera before 12.11 allows remote attackers to determine the existence of arbitrary local files via vectors involving web script in an error page. |
CVE-2012-6468 | | | 2013-01-02 | Heap-based buffer overflow in Opera before 12.11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a long… |
CVE-2012-6467 | | | 2013-01-02 | Opera before 12.10 follows Internet shortcuts that are referenced by a (1) IMG element or (2) other inline element, which makes it easier for remote attackers… |
CVE-2012-6466 | | | 2013-01-02 | Opera before 12.10 does not properly handle incorrect size data in a WebP image, which allows remote attackers to obtain potentially sensitive information from… |
CVE-2012-6465 | | | 2013-01-02 | Opera before 12.10 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a malformed SVG image. |
CVE-2012-6464 | | | 2013-01-02 | Cross-site scripting (XSS) vulnerability in Opera before 12.10 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript code that… |
CVE-2012-6463 | | | 2013-01-02 | Cross-site scripting (XSS) vulnerability in Opera before 12.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an unspecif… |
CVE-2012-6462 | | | 2013-01-02 | Opera before 12.10 does not properly implement the Cross-Origin Resource Sharing (CORS) specification, which allows remote attackers to bypass intended page-co… |
CVE-2012-6461 | | | 2013-01-02 | The X.509 certificate-validation functionality in the https implementation in Opera before 12.10 allows remote attackers to trigger a false indication of succe… |
CVE-2012-6460 | | | 2013-01-02 | Opera before 11.67 and 12.x before 12.02 allows remote attackers to cause truncation of a dialog, and possibly trigger downloading and execution of arbitrary p… |
CVE-2012-5180 | | | 2012-12-26 | The Opera Mobile application before 12.1 and Opera Mini application before 7.5 for Android do not properly implement the WebView class, which allows attackers… |
CVE-2010-5227 | | | 2012-09-07 | Untrusted search path vulnerability in Opera before 10.62 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working direc… |
CVE-2012-4010 | | | 2012-08-30 | Opera before 11.60 allows remote attackers to spoof the address bar via unspecified homograph characters, a different vulnerability than CVE-2010-2660. |
CVE-2012-4146 | | | 2012-08-06 | Opera before 12.01 allows remote attackers to cause a denial of service (application crash) via a crafted web site, as demonstrated by the Lenovo "Shop now" pa… |
CVE-2012-4145 | | | 2012-08-06 | Unspecified vulnerability in Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, has unknown impact and attack vectors… |
CVE-2012-4144 | | | 2012-08-06 | Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, does not properly escape characters in DOM elements, which makes it… |
CVE-2012-4143 | | | 2012-08-06 | Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, allows user-assisted remote attackers to trick users into downloadi… |
CVE-2012-4142 | | | 2012-08-06 | Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, ignores some characters in HTML documents in unspecified circumstan… |
CVE-2012-3568 | | | 2012-06-14 | Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via crafted WebGL content, as demonstrated by a codeflow.org W… |
CVE-2012-3567 | | | 2012-06-14 | Opera before 12.00 Beta allows remote attackers to cause a denial of service (memory consumption or application hang) via an IFRAME element that uses the src="… |
CVE-2012-3566 | | | 2012-06-14 | Opera before 12.00 Beta allows user-assisted remote attackers to cause a denial of service (application hang) via JavaScript code that changes a form before su… |
CVE-2012-3565 | | | 2012-06-14 | Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via crafted characters in domain names, as demonstrated by "ID… |
CVE-2012-3564 | | | 2012-06-14 | Opera before 12.00 Beta allows remote attackers to cause a denial of service (application hang) via an absolutely positioned wrap=off TEXTAREA element located… |
CVE-2012-3563 | | | 2012-06-14 | Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via a web page that contains invalid character encodings. |
CVE-2012-3562 | | | 2012-06-14 | Opera before 12.00 Beta allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted web page that is not properly hand… |
CVE-2012-3561 | | | 2012-06-14 | Opera before 11.64 does not properly allocate memory for URL strings, which allows remote attackers to execute arbitrary code or cause a denial of service (mem… |
CVE-2012-3560 | | | 2012-06-14 | Opera before 11.65 does not ensure that the address field corresponds to the displayed web page during blocked navigation, which makes it easier for remote att… |
CVE-2012-3559 | | | 2012-06-14 | Unspecified vulnerability in Opera before 12.00 on Mac OS X has unknown impact and attack vectors, related to a "moderate severity issue." |
CVE-2012-3558 | | | 2012-06-14 | Opera before 11.65 does not ensure that the address field corresponds to the displayed web page during unusually timed changes to this field, which makes it ea… |
CVE-2012-3557 | | | 2012-06-14 | Opera before 11.65 does not properly restrict the reading of JSON strings, which allows remote attackers to perform cross-domain loading of JSON resources and… |
CVE-2012-3556 | | | 2012-06-14 | Opera before 11.65 does not properly restrict the opening of a pop-up window in response to the first click of a double-click action, which makes it easier for… |
CVE-2012-3555 | | | 2012-06-14 | Opera before 11.65 does not ensure that keyboard sequences are associated with a visible window, which makes it easier for user-assisted remote attackers to co… |
CVE-2012-1251 | | | 2012-06-04 | Opera before 9.63 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive… |
CVE-2012-1931 | | | 2012-03-28 | Opera before 11.62 on UNIX, when used in conjunction with an unspecified printing application, allows local users to overwrite arbitrary files via a symlink at… |
CVE-2012-1930 | | | 2012-03-28 | Opera before 11.62 on UNIX uses world-readable permissions for temporary files during printing, which allows local users to obtain sensitive information by rea… |
CVE-2012-1929 | | | 2012-03-28 | Opera before 11.62 on Mac OS X allows remote attackers to spoof the address field and security dialogs via crafted styling that causes page content to be displ… |
CVE-2012-1928 | | | 2012-03-28 | Opera before 11.62 allows remote attackers to spoof the address field by triggering a page reload followed by a redirect to a different domain. |
CVE-2012-1927 | | | 2012-03-28 | Opera before 11.62 allows remote attackers to spoof the address field by triggering the launch of a dialog window associated with a different domain. |
CVE-2012-1926 | | | 2012-03-28 | Opera before 11.62 allows remote attackers to bypass the Same Origin Policy via the (1) history.pushState and (2) history.replaceState functions in conjunction… |
CVE-2012-1925 | | | 2012-03-28 | Opera before 11.62 does not ensure that a dialog window is placed on top of content windows, which makes it easier for user-assisted remote attackers to trick… |
CVE-2012-1924 | | | 2012-03-28 | Opera before 11.62 allows user-assisted remote attackers to trick users into downloading and executing arbitrary files via a small window for the download dial… |
CVE-2012-1003 | | | 2012-02-07 | Multiple integer overflows in Opera 11.60 and earlier allow remote attackers to cause a denial of service (application crash) via a large integer argument to t… |
CVE-2011-4690 | | | 2011-12-07 | Opera 11.60 and earlier does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes it easier… |
CVE-2011-4687 | | | 2011-12-07 | Opera before 11.60 allows remote attackers to cause a denial of service (CPU and memory consumption) via unspecified content on a web page, as demonstrated by… |
CVE-2011-4686 | | | 2011-12-07 | Unspecified vulnerability in the Web Workers implementation in Opera before 11.60 allows remote attackers to cause a denial of service (application crash) via… |
CVE-2011-4685 | | | 2011-12-07 | Dragonfly in Opera before 11.60 allows remote attackers to cause a denial of service (application crash) via unspecified content on a web page, as demonstrated… |
CVE-2011-4684 | | | 2011-12-07 | Opera before 11.60 does not properly handle certificate revocation, which has unspecified impact and remote attack vectors related to "corner cases." |
CVE-2011-4683 | | | 2011-12-07 | Unspecified vulnerability in Opera before 11.60 has unknown impact and attack vectors, related to a "moderately severe issue." |
CVE-2011-4682 | | | 2011-12-07 | The JavaScript engine in Opera before 11.60 does not properly implement the in operator, which allows remote attackers to bypass the Same Origin Policy via vec… |
CVE-2011-4681 | | | 2011-12-07 | Opera before 11.60 does not properly consider the number of . (dot) characters that conventionally exist in domain names of different top-level domains, which… |
CVE-2010-5072 | | | 2011-12-07 | The JavaScript implementation in Opera 10.5 does not properly restrict the set of values contained in the object returned by the getComputedStyle method, which… |
CVE-2010-5068 | | | 2011-12-07 | The Cascading Style Sheets (CSS) implementation in Opera 10.5 does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensi… |
CVE-2011-3389 | | | 2011-09-06 | The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other prod… |
CVE-2011-3388 | | | 2011-09-06 | Opera before 11.51 allows remote attackers to cause an insecure site to appear secure or trusted via unspecified actions related to Extended Validation and loa… |
CVE-2008-7297 | | | 2011-08-09 | Opera cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrar… |
CVE-2011-2641 | | | 2011-07-01 | Opera 11.11 allows remote attackers to cause a denial of service (application crash) by setting the FACE attribute of a FONT element within an IFRAME element a… |
CVE-2011-2640 | | | 2011-07-01 | Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via an HTML document that has an empty parameter value for an embed… |
CVE-2011-2639 | | | 2011-07-01 | Opera before 11.10 does not properly handle hidden animated GIF images, which allows remote attackers to cause a denial of service (CPU consumption) via an ima… |
CVE-2011-2638 | | | 2011-07-01 | Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as… |
CVE-2011-2637 | | | 2011-07-01 | Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as… |
CVE-2011-2636 | | | 2011-07-01 | Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as… |
CVE-2011-2635 | | | 2011-07-01 | The Cascading Style Sheets (CSS) implementation in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via vectors invo… |
CVE-2011-2634 | | | 2011-07-01 | Opera before 11.10 allows remote attackers to hijack (1) searches and (2) customizations via unspecified third party applications. |
CVE-2011-2633 | | | 2011-07-01 | Unspecified vulnerability in Opera before 11.11 allows remote attackers to cause a denial of service (application crash) via vectors involving a Certificate Re… |
CVE-2011-2632 | | | 2011-07-01 | Opera before 11.11 does not properly handle destruction of a Silverlight instance, which allows remote attackers to cause a denial of service (application cras… |
CVE-2011-2631 | | | 2011-07-01 | The Cascading Style Sheets (CSS) implementation in Opera before 11.11 does not properly handle the column-count property, which allows remote attackers to caus… |
CVE-2011-2630 | | | 2011-07-01 | Opera before 11.11 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted web page that is not properly handled d… |
CVE-2011-2629 | | | 2011-07-01 | Unspecified vulnerability in Opera before 11.11 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as… |
CVE-2011-2628 | | | 2011-07-01 | Opera before 11.11 does not properly implement FRAMESET elements, which allows remote attackers to execute arbitrary code or cause a denial of service (memory… |
CVE-2011-2627 | | | 2011-07-01 | Unspecified vulnerability in the DOM implementation in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via unknown… |