Opera
Page 3 of 4 — Opera CVEs from a corpus of 302, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2008-5679 | | 2008-12-19 | The HTML parsing engine in Opera before 9.63 allows remote attackers to execute arbitrary code via crafted web pages that trigger an invalid pointer calculatio… | |
CVE-2008-5428 | | 2008-12-11 | Opera 9.51 on Windows XP does not properly handle (1) multipart/mixed e-mail messages with many MIME parts and possibly (2) e-mail messages with many "Content-… | |
CVE-2008-5178 | | 2008-11-20 | Heap-based buffer overflow in Opera 9.62 on Windows allows remote attackers to execute arbitrary code via a long file:// URI. NOTE: this might overlap CVE-200… | |
CVE-2008-4795 | | 2008-10-30 | The links panel in Opera before 9.62 processes Javascript within the context of the "outermost page" of a frame, which allows remote attackers to inject arbitr… | |
CVE-2008-4794 | | 2008-10-30 | Opera before 9.62 allows remote attackers to execute arbitrary commands via the History Search results page, a different vulnerability than CVE-2008-4696. | |
CVE-2008-4725 | | 2008-10-23 | Cross-site scripting (XSS) vulnerability in Opera.dll in Opera 9.52 allows remote attackers to inject arbitrary web script or HTML via the query string, which… | |
CVE-2008-4698 | | 2008-10-23 | Opera before 9.61 does not properly block scripts during preview of a news feed, which allows remote attackers to create arbitrary new feed subscriptions and r… | |
CVE-2008-4697 | | 2008-10-23 | The Fast Forward feature in Opera before 9.61, when a page is located in a frame, executes a javascript: URL in the context of the outermost page instead of th… | |
CVE-2008-4696 | | 2008-10-23 | Cross-site scripting (XSS) vulnerability in Opera.dll in Opera before 9.61 allows remote attackers to inject arbitrary web script or HTML via the anchor identi… | |
CVE-2008-4695 | | 2008-10-23 | Opera before 9.60 allows remote attackers to obtain sensitive information and have unspecified other impact by predicting the cache pathname of a cached Java a… | |
CVE-2008-4694 | | 2008-10-23 | Unspecified vulnerability in Opera before 9.60 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a redirec… | |
CVE-2008-4293 | | 2008-09-27 | Unspecified vulnerability in Opera before 9.52 on Windows, when registered as a protocol handler, allows remote attackers to cause a denial of service (crash)… | |
CVE-2008-4292 | | 2008-09-27 | Opera before 9.52 does not check the CRL override upon encountering a certificate that lacks a CRL, which has unknown impact and attack vectors. NOTE: it is n… | |
CVE-2008-4200 | | 2008-09-27 | Opera before 9.52 does not ensure that the address field of a news feed represents the feed's actual URL, which allows remote attackers to change this field to… | |
CVE-2008-4199 | | 2008-09-27 | Opera before 9.52 does not prevent use of links from web pages to feed source files on the local disk, which might allow remote attackers to determine the vali… | |
CVE-2008-4198 | | 2008-09-27 | Opera before 9.52, when rendering an http page that has loaded an https page into a frame, displays a padlock icon and offers a security information dialog rep… | |
CVE-2008-4197 | High | 8.8 | 2008-09-27 | Opera before 9.52 on Windows, Linux, FreeBSD, and Solaris, when processing custom shortcut and menu commands, can produce argument strings that contain uniniti… |
CVE-2008-4196 | | 2008-09-27 | Cross-site scripting (XSS) vulnerability in Opera before 9.52 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |
CVE-2008-4195 | | 2008-09-27 | Opera before 9.52 does not properly restrict the ability of a framed web page to change the address associated with a different frame, which allows remote atta… | |
CVE-2008-3172 | | 2008-07-14 | Opera allows web sites to set cookies for country-specific top-level domains that have DNS A records, such as co.tv, which could allow remote attackers to perf… | |
CVE-2008-3079 | | 2008-07-09 | Unspecified vulnerability in Opera before 9.51 on Windows allows attackers to execute arbitrary code via unknown vectors. | |
CVE-2008-3078 | | 2008-07-09 | Opera before 9.51 does not properly manage memory within functions supporting the CANVAS element, which allows remote attackers to read uninitialized memory co… | |
CVE-2008-2716 | | 2008-06-16 | Unspecified vulnerability in Opera before 9.5 allows remote attackers to spoof the contents of trusted frames on the same parent page by modifying the location… | |
CVE-2008-2715 | | 2008-06-16 | Unspecified vulnerability in Opera before 9.5 allows remote attackers to read cross-domain images via HTML CANVAS elements that use the images as patterns. | |
CVE-2008-2714 | | 2008-06-16 | Opera before 9.26 allows remote attackers to misrepresent web page addresses using "certain characters" that "cause the page address text to be misplaced." | |
CVE-2008-1764 | | 2008-04-12 | Unspecified vulnerability in Opera before 9.27 has unknown impact and attack vectors related to "keyboard handling of password inputs." | |
CVE-2008-1762 | | 2008-04-12 | Opera before 9.27 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted scaled image pattern in an HTM… | |
CVE-2008-1761 | | 2008-04-12 | Opera before 9.27 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted newsfeed source, which trigger… | |
CVE-2008-1082 | | 2008-02-29 | Opera before 9.26 allows remote attackers to "bypass sanitization filters" and conduct cross-site scripting (XSS) attacks via crafted attribute values in an XM… | |
CVE-2008-1081 | | 2008-02-29 | Opera before 9.26 allows user-assisted remote attackers to execute arbitrary script via images that contain custom comments, which are treated as script when t… | |
CVE-2008-1080 | | 2008-02-29 | Opera before 9.26 allows user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the target filename into a fil… | |
CVE-2007-6524 | | 2007-12-24 | Opera before 9.25 allows remote attackers to obtain potentially sensitive memory contents via a crafted bitmap (BMP) file, as demonstrated using a CANVAS eleme… | |
CVE-2007-6523 | | 2007-12-24 | Algorithmic complexity vulnerability in Opera 9.50 beta and 9.x before 9.25 allows remote attackers to cause a denial of service (CPU consumption) via a crafte… | |
CVE-2007-6522 | | 2007-12-24 | The rich text editing functionality in Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks by using designMode to modify conten… | |
CVE-2007-6521 | | 2007-12-24 | Unspecified vulnerability in Opera before 9.25 allows remote attackers to execute arbitrary code via crafted TLS certificates. | |
CVE-2007-6520 | | 2007-12-24 | Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks via unknown vectors related to plug-ins. | |
CVE-2007-5541 | | 2007-10-18 | Unspecified vulnerability in Opera before 9.24, when using an "external" newsgroup or e-mail client, allows remote attackers to execute arbitrary commands via… | |
CVE-2007-5540 | | 2007-10-18 | Unspecified vulnerability in Opera before 9.24 allows remote attackers to overwrite functions on pages from other domains and bypass the same-origin policy via… | |
CVE-2007-5476 | | 2007-10-18 | Unspecified vulnerability in Adobe Flash Player 9.0.47.0 and earlier, when running on Opera before 9.24 on Mac OS X, has unknown "Highly Severe" impact and unk… | |
CVE-2007-5276 | | 2007-10-08 | Opera 9 drops DNS pins based on failed connections to irrelevant TCP ports, which makes it easier for remote attackers to conduct DNS rebinding attacks, as dem… | |
CVE-2007-5274 | | 2007-10-08 | Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and… | |
CVE-2007-4944 | | 2007-09-18 | The canvas.createPattern function in Opera 9.x before 9.22 for Linux, FreeBSD, and Solaris does not clear memory before using it to process a new pattern, whic… | |
CVE-2007-4367 | | 2007-08-15 | Opera before 9.23 allows remote attackers to execute arbitrary code via crafted Javascript that triggers a "virtual function call on an invalid pointer." | |
CVE-2007-3929 | | 2007-07-21 | Use-after-free vulnerability in the BitTorrent support in Opera before 9.22 allows user-assisted remote attackers to execute arbitrary code via a crafted heade… | |
CVE-2007-3819 | | 2007-07-17 | Opera 9.21 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of th… | |
CVE-2007-3142 | | 2007-06-11 | Visual truncation vulnerability in Opera 9.21 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a long hostname, which… | |
CVE-2007-2809 | | 2007-05-22 | Buffer overflow in the transfer manager in Opera before 9.21 for Windows allows user-assisted remote attackers to execute arbitrary code via a crafted torrent… | |
CVE-2007-2274 | | 2007-04-25 | The BitTorrent implementation in Opera 9.2 allows remote attackers to cause a denial of service (CPU consumption and application crash) via a malformed torrent… | |
CVE-2007-2022 | | 2007-04-13 | Adobe Macromedia Flash Player 7 and 9, when used with Opera before 9.20 or Konqueror before 20070613, allows remote attackers to obtain sensitive information (… | |
CVE-2007-1737 | | 2007-03-28 | Opera 9.10 does not check URLs embedded in (1) object or (2) iframe HTML tags against the phishing site blacklist, which allows remote attackers to bypass phis… | |
CVE-2007-1563 | | 2007-03-21 | The FTP protocol implementation in Opera 9.10 allows remote attackers to allows remote servers to force the client to connect to other servers, perform a proxi… | |
CVE-2007-1377 | | 2007-03-10 | AcroPDF.DLL in Adobe Reader 8.0, when accessed from Mozilla Firefox, Netscape, or Opera, allows remote attackers to cause a denial of service (unspecified reso… | |
CVE-2007-1115 | | 2007-02-26 | The child frames in Opera 9 before 9.20 inherit the default charset from the parent window when a charset is not specified in an HTTP Content-Type header or ME… | |
CVE-2007-0802 | | 2007-02-07 | Mozilla Firefox 2.0.0.1 allows remote attackers to bypass the Phishing Protection mechanism by adding certain characters to the end of the domain name, as demo… | |
CVE-2006-6970 | | 2007-02-07 | Opera 9.10 Final allows remote attackers to bypass the Fraud Protection mechanism by adding certain characters to the end of a domain name, as demonstrated by… | |
CVE-2006-6955 | | 2007-01-29 | Opera allows remote attackers to cause a denial of service (application crash) via a web page that contains a large number of nested marquee tags, a related is… | |
CVE-2007-0127 | | 2007-01-09 | The Javascript SVG support in Opera before 9.10 does not properly validate object types in a createSVGTransformFromMatrix request, which allows remote attacker… | |
CVE-2007-0126 | | 2007-01-09 | Heap-based buffer overflow in Opera 9.02 allows remote attackers to execute arbitrary code via a JPEG file with an invalid number of index bytes in the Define… | |
CVE-2006-4819 | | 2006-10-17 | Heap-based buffer overflow in Opera 9.0 and 9.01 allows remote attackers to execute arbitrary code via a long URL in a tag (long link address). | |
CVE-2006-3945 | | 2006-07-31 | The CSS functionality in Opera 9 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by setting the background property of a DHTML e… | |
CVE-2006-3353 | | 2006-07-06 | Opera 9 allows remote attackers to cause a denial of service (crash) via a crafted web page that triggers an out-of-bounds memory access, related to an iframe… | |
CVE-2006-3331 | | 2006-06-30 | Opera before 9.0 does not reset the SSL security bar after displaying a download dialog from an SSL-enabled website, which allows remote attackers to spoof a t… | |
CVE-2006-3199 | | 2006-06-23 | Opera 9 allows remote attackers to cause a denial of service (crash) via an A tag with an href attribute with a URL containing a long hostname, which triggers… | |
CVE-2006-3198 | | 2006-06-23 | Integer overflow in Opera 8.54 and earlier allows remote attackers to execute arbitrary code via a JPEG image with large height and width values, which causes… | |
CVE-2006-1834 | | 2006-04-19 | Integer signedness error in Opera before 8.54 allows remote attackers to execute arbitrary code via long values in a stylesheet attribute, which pass a length… | |
CVE-2005-4718 | | 2005-12-31 | Opera 8.02 and earlier allows remote attackers to cause a denial of service (client crash) via (1) a crafted HTML file with a "content: url(0);" style attribut… | |
CVE-2005-4210 | | 2005-12-13 | Opera before 8.51, when running on Windows with Input Method Editor (IME) installed, allows remote attackers to cause a denial of service (persistent applicati… | |
CVE-2005-3946 | | 2005-12-01 | Opera 8.50 allows remote attackers to cause a denial of service (crash) via a Java applet with a large string argument to the removeMember JNI method for the c… | |
CVE-2005-3750 | | 2005-11-22 | Opera before 8.51 on Linux and Unix systems allows remote attackers to execute arbitrary code via shell metacharacters (backticks) in a URL that another produc… | |
CVE-2005-3699 | | 2005-11-21 | Opera Web Browser 8.50 and 8.0 through 8.0.2 allows remote attackers to spoof the URL in the status bar via the title in an image in a link to a trusted site w… | |
CVE-2005-3059 | | 2005-09-26 | Multiple unspecified vulnerabilities in Opera 8.50 on Linux and Windows have unknown impact and attack vectors, related to (1) " handling of must-revalidate ca… | |
CVE-2005-3041 | | 2005-09-22 | Unspecified "drag-and-drop vulnerability" in Opera Web Browser before 8.50 on Windows allows "unintentional file uploads." | |
CVE-2005-3007 | | 2005-09-21 | Opera before 8.50 allows remote attackers to spoof the content type of files via a filename with a trailing "." (dot), which might allow remote attackers to tr… | |
CVE-2005-3006 | | 2005-09-21 | The mail client in Opera before 8.50 opens attached files from the user's cache directory without warning the user, which might allow remote attackers to injec… | |
CVE-2005-2407 | | 2005-08-01 | A design error in Opera 8.01 and earlier allows user-assisted attackers to execute arbitrary code by overlaying a malicious new window above a file download di… | |
CVE-2005-2406 | | 2005-08-01 | Opera 8.01 allows remote attackers to conduct cross-site scripting (XSS) attacks or modify which files are uploaded by tricking a user into dragging an image t… | |
CVE-2005-2405 | | 2005-08-01 | Opera 8.01, when the "Arial Unicode MS" font (ARIALUNI.TTF) is installed, does not properly handle extended ASCII characters in the file download dialog box, w… | |
CVE-2005-2309 | | 2005-07-19 | Opera 8.01 allows remote attackers to cause a denial of service (CPU consumption) via a crafted JPEG image, as demonstrated using random.jpg. | |
CVE-2005-2273 | | 2005-07-13 | Opera 7.x and 8 before 8.01 does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a di… | |
CVE-2005-1669 | | 2005-06-16 | Cross-site scripting (XSS) vulnerability in Opera 8.0 Final Build 1095 allows remote attackers to inject arbitrary web script or HTML via "javascript:" URLs wh… | |
CVE-2005-1475 | | 2005-06-16 | The XMLHttpRequest object in Opera 8.0 Final Build 1095 allows remote attackers to bypass access restrictions and perform unauthorized actions on other domains… | |
CVE-2005-0457 | | 2005-05-02 | Opera 7.54 and earlier on Gentoo Linux uses an insecure path for plugins, which could allow local users to gain privileges by inserting malicious libraries int… | |
CVE-2005-0238 | | 2005-05-02 | The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in U… | |
CVE-2005-0235 | | 2005-05-02 | The International Domain Name (IDN) support in Opera 7.54 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in… | |
CVE-2005-1139 | | 2005-04-14 | Opera 8 Beta 3, when using first-generation vetted digital certificates, displays the Organizational information of an SSL certificate, which is easily spoofed… | |
CVE-2005-0233 | | 2005-02-08 | The International Domain Name (IDN) support in Firefox 1.0, Camino .8.5, and Mozilla before 1.7.6 allows remote attackers to spoof domain names using punycode… | |
CVE-2005-0456 | | 2005-01-12 | Opera 7.54 and earlier does not properly validate base64 encoded binary data in a data: (RFC 2397) URL, which causes the URL to be obscured in a download dialo… | |
CVE-2004-1201 | | 2005-01-10 | Opera 7.54 allows remote attackers to cause a denial of service (application crash from memory exhaustion), as demonstrated using Javascript code that continuo… | |
CVE-2004-1157 | | 2005-01-10 | Opera 7.x up to 7.54, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target wind… | |
CVE-2004-2659 | | 2004-12-31 | Opera offers an Open button to verify that a user wishes to execute a downloaded file, which allows user-assisted remote attackers to construct a race conditio… | |
CVE-2004-2570 | | 2004-12-31 | Opera before 7.54 allows remote attackers to modify properties and methods of the location object and execute Javascript to read arbitrary files from the clien… | |
CVE-2004-2491 | | 2004-12-31 | A race condition in Opera web browser 7.53 Build 3850 causes Opera to fill in the address bar before the page has been loaded, which allows remote attackers to… | |
CVE-2004-2260 | | 2004-12-31 | Opera Browser 7.23, and other versions before 7.50, updates the address bar as soon as the user clicks a link, which allows remote attackers to redirect to oth… | |
CVE-2004-1810 | | 2004-12-31 | The Javascript engine in Opera 7.23 allows remote attackers to cause a denial of service (crash) by creating a new Array object with a large size value, then w… | |
CVE-2004-1491 | | 2004-12-31 | Opera 7.54 and earlier uses kfmclient exec to handle unknown MIME types, which allows remote attackers to execute arbitrary code via a shortcut or launcher tha… | |
CVE-2004-1490 | | 2004-12-31 | Opera 7.54 and earlier allows remote attackers to spoof file types in the download dialog via dots and non-breaking spaces (ASCII character code 160) in the (1… | |
CVE-2004-1489 | | 2004-12-31 | Opera 7.54 and earlier does not properly limit an applet's access to internal Java packages from Sun, which allows remote attackers to gain sensitive informati… | |
CVE-2004-1615 | | 2004-10-18 | Opera allows remote attackers to cause a denial of service (invalid memory reference and application crash) via a web page or HTML email that contains a TBODY… | |
CVE-2004-0872 | | 2004-09-16 | Opera does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the same domain, which c… | |
CVE-2004-0537 | | 2004-08-06 | Opera 7.50 and earlier allows remote web sites to provide a "Shortcut Icon" (favicon) that is wider than expected, which could allow the web sites to spoof a t… |