CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Opera Software : Security Vulnerabilities

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complex ity Authen tication Confiden tiality Integrity Availa bility
1 CVE-2009-3832 20 2009-10-30 2010-08-21
5.8
 None Remote Medium Not required None Partial Partial
Opera before 10.01 on Windows does not prevent use of Web fonts in rendering the product's own user interface, which allows remote attackers to spoof the address field via a crafted web site.
2 CVE-2009-3831 94 DoS Exec Code Mem. Corr. 2009-10-30 2010-08-21
9.3
 None Remote Medium Not required Complete Complete Complete
Opera before 10.01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted domain name.
3 CVE-2009-0916 2009-03-16 2009-04-01
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in Opera before 9.64 has unknown impact and attack vectors, related to a "moderately severe issue."
4 CVE-2009-0915 2009-03-16 2010-08-21
6.8
 None Remote Medium Not required Partial Partial Partial
Opera before 9.64 allows remote attackers to conduct cross-domain scripting attacks via unspecified vectors related to plug-ins.
5 CVE-2009-0914 399 Exec Code Mem. Corr. 2009-03-16 2010-08-21
9.3
 None Remote Medium Not required Complete Complete Complete
Opera before 9.64 allows remote attackers to execute arbitrary code via a crafted JPEG image that triggers memory corruption.
6 CVE-2008-3078 200 +Info 2008-07-08 2009-05-14
7.8
 None Remote Low Not required Complete None None
Opera before 9.51 does not properly manage memory within functions supporting the CANVAS element, which allows remote attackers to read uninitialized memory contents by using JavaScript to read a canvas image.
7 CVE-2008-2716 2008-06-16 2009-04-14
5.0
 None Remote Low Not required None Partial None
Unspecified vulnerability in Opera before 9.5 allows remote attackers to spoof the contents of trusted frames on the same parent page by modifying the location, which can facilitate phishing attacks.
8 CVE-2008-2715 200 +Info 2008-06-16 2009-04-14
5.0
 None Remote Low Not required Partial None None
Unspecified vulnerability in Opera before 9.5 allows remote attackers to read cross-domain images via HTML CANVAS elements that use the images as patterns.
9 CVE-2008-2714 2008-06-16 2009-04-14
5.0
 None Remote Low Not required None Partial None
Opera before 9.26 allows remote attackers to misrepresent web page addresses using "certain characters" that "cause the page address text to be misplaced."
10 CVE-2008-1082 79 XSS Bypass 2008-02-28 2008-09-05
4.3
 None Remote Medium Not required None Partial None
Opera before 9.26 allows remote attackers to "bypass sanitization filters" and conduct cross-site scripting (XSS) attacks via crafted attribute values in an XML document, which are not properly handled during DOM presentation.
11 CVE-2008-1081 94 2008-02-28 2008-09-05
6.8
 User Remote Medium Not required Partial Partial Partial
Opera before 9.26 allows user-assisted remote attackers to execute arbitrary script via images that contain custom comments, which are treated as script when the user displays the image properties.
12 CVE-2008-1080 20 2008-02-28 2008-09-05
6.8
 None Remote Medium Not required Partial Partial Partial
Opera before 9.26 allows user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the target filename into a file input.
13 CVE-2007-6523 399 DoS 2007-12-24 2008-09-05
7.8
 None Remote Low Not required None None Complete
Algorithmic complexity vulnerability in Opera 9.50 beta and 9.x before 9.25 allows remote attackers to cause a denial of service (CPU consumption) via a crafted bitmap (BMP) file that triggers a large number of calculations and checks.
14 CVE-2007-6522 79 XSS 2007-12-24 2008-09-05
4.3
 None Remote Medium Not required None Partial None
The rich text editing functionality in Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks by using designMode to modify contents of pages in other domains.
15 CVE-2007-6521 310 Exec Code 2007-12-24 2008-09-05
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in Opera before 9.25 allows remote attackers to execute arbitrary code via crafted TLS certificates.
16 CVE-2007-6520 79 XSS 2007-12-24 2008-09-05
4.3
 None Remote Medium Not required None Partial None
Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks via unknown vectors related to plug-ins.
17 CVE-2007-5541 20 Exec Code 2007-10-17 2008-11-15
9.3
 None Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in Opera before 9.24, when using an "external" newsgroup or e-mail client, allows remote attackers to execute arbitrary commands via unknown vectors.
18 CVE-2007-5540 20 Bypass 2007-10-17 2008-11-15
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Opera before 9.24 allows remote attackers to overwrite functions on pages from other domains and bypass the same-origin policy via unknown vectors.
19 CVE-2007-5476 2007-10-17 2008-09-05
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in Adobe Flash Player 9.0.47.0 and earlier, when running on Opera before 9.24 on Mac OS X, has unknown "Highly Severe" impact and unknown attack vectors.
20 CVE-2007-5276 2007-10-08 2008-11-15
4.3
 None Remote Medium Not required None Partial None
Opera 9 drops DNS pins based on failed connections to irrelevant TCP ports, which makes it easier for remote attackers to conduct DNS rebinding attacks, as demonstrated by a port 81 URL in an IMG SRC, when the DNS pin had been established for a session on port 80.
21 CVE-2007-4944 +Info 2007-09-18 2008-11-15
5.0
 None Remote Low Not required Partial None None
The canvas.createPattern function in Opera 9.x before 9.22 for Linux, FreeBSD, and Solaris does not clear memory before using it to process a new pattern, which allows remote attackers to obtain sensitive information (memory contents) via JavaScript.
22 CVE-2007-4367 Exec Code 2007-08-15 2008-09-05
9.3
 Admin Remote Medium Not required Complete Complete Complete
Opera before 9.23 allows remote attackers to execute arbitrary code via crafted Javascript that triggers a "virtual function call on an invalid pointer."
23 CVE-2007-3929 119 Exec Code Overflow 2007-07-20 2008-09-05
9.3
 None Remote Medium Not required Complete Complete Complete
Use-after-free vulnerability in the BitTorrent support in Opera before 9.22 allows user-assisted remote attackers to execute arbitrary code via a crafted header in a torrent file, which leaves a dangling pointer to an invalid object.
24 CVE-2007-3819 2007-07-16 2008-09-05
5.0
 None Remote Low Not required None Partial None
Opera 9.21 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed.
25 CVE-2007-3142 2007-06-11 2008-11-15
5.8
 None Remote Medium Not required Partial Partial None
Visual truncation vulnerability in Opera 9.21 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a long hostname, which is truncated after 34 characters, as demonstrated by a phishing attack using HTTP Basic Authentication.
26 CVE-2007-2809 Exec Code Overflow 2007-05-22 2008-09-05
9.3
 Admin Remote Medium Not required Complete Complete Complete
Buffer overflow in the transfer manager in Opera before 9.21 for Windows allows user-assisted remote attackers to execute arbitrary code via a crafted torrent file. NOTE: due to the lack of details, it is not clear if this is the same issue as CVE-2007-2274.
27 CVE-2007-2274 1 DoS 2007-04-25 2009-10-14
7.8
 None Remote Low Not required None None Complete
The BitTorrent implementation in Opera 9.2 allows remote attackers to cause a denial of service (CPU consumption and application crash) via a malformed torrent file. NOTE: the original disclosure refers to this as a memory leak, but it is not certain.
28 CVE-2007-1737 Bypass 2007-03-28 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Opera 9.10 does not check URLs embedded in (1) object or (2) iframe HTML tags against the phishing site blacklist, which allows remote attackers to bypass phishing protection.
29 CVE-2007-1377 1 DoS 2007-03-09 2008-11-15
5.0
 None Remote Low Not required None None Partial
AcroPDF.DLL in Adobe Reader 8.0, when accessed from Mozilla Firefox, Netscape, or Opera, allows remote attackers to cause a denial of service (unspecified resource consumption) via a .pdf URL with an anchor identifier that begins with search= followed by many %n sequences, a different vulnerability than CVE-2006-6027 and CVE-2006-6236.
30 CVE-2007-0802 264 Bypass 2007-02-07 2008-11-15
6.4
 None Remote Low Not required Partial Partial None
Mozilla Firefox 2.0.0.1 allows remote attackers to bypass the Phishing Protection mechanism by adding certain characters to the end of the domain name, as demonstrated by the "." and "/" characters, which is not caught by the Phishing List blacklist filter.
31 CVE-2007-0127 94 Exec Code 2007-01-08 2008-11-15
9.3
 None Remote Medium Not required Complete Complete Complete
The Javascript SVG support in Opera before 9.10 does not properly validate object types in a createSVGTransformFromMatrix request, which allows remote attackers to execute arbitrary code via JavaScript code that uses an invalid object in this request that causes a controlled pointer to be referenced during the virtual function call.
32 CVE-2007-0126 119 Exec Code Overflow 2007-01-08 2008-11-15
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in Opera 9.02 allows remote attackers to execute arbitrary code via a JPEG file with an invalid number of index bytes in the Define Huffman Table (DHT) marker.
33 CVE-2006-6970 264 Bypass 2007-02-07 2008-11-15
5.0
 None Remote Low Not required Partial None None
Opera 9.10 Final allows remote attackers to bypass the Fraud Protection mechanism by adding certain characters to the end of a domain name, as demonstrated by the "." and "/" characters, which is not caught by the blacklist filter.
34 CVE-2006-4819 Exec Code Overflow 2006-10-17 2008-09-05
5.1
 User Remote High Not required Partial Partial Partial
Heap-based buffer overflow in Opera 9.0 and 9.01 allows remote attackers to execute arbitrary code via a long URL in a tag (long link address).
35 CVE-2006-3945 DoS Mem. Corr. 2006-07-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
The CSS functionality in Opera 9 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by setting the background property of a DHTML element to a long http or https URL, which triggers memory corruption.
36 CVE-2006-3353 DoS 2006-07-05 2008-09-05
5.0
 None Remote Low Not required None None Partial
Opera 9 allows remote attackers to cause a denial of service (crash) via a crafted web page that triggers an out-of-bounds memory access, related to an iframe and JavaScript that accesses certain style sheets properties.
37 CVE-2006-3331 2006-06-30 2008-09-05
5.0
 None Remote Low Not required None Partial None
Opera before 9.0 does not reset the SSL security bar after displaying a download dialog from an SSL-enabled website, which allows remote attackers to spoof a trusted SSL certificate from an untrusted website and facilitates phishing attacks.
38 CVE-2006-3199 DoS 2006-06-23 2008-09-05
5.0
 None Remote Low Not required None None Partial
Opera 9 allows remote attackers to cause a denial of service (crash) via an A tag with an href attribute with a URL containing a long hostname, which triggers an out-of-bounds operation.
39 CVE-2006-3198 Exec Code Overflow 2006-06-23 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Integer overflow in Opera 8.54 and earlier allows remote attackers to execute arbitrary code via a JPEG image with large height and width values, which causes less memory to be allocated than intended.
40 CVE-2006-1834 Exec Code 2006-04-19 2008-09-05
5.1
 User Remote High Not required Partial Partial Partial
Integer signedness error in Opera before 8.54 allows remote attackers to execute arbitrary code via long values in a stylesheet attribute, which pass a length check. NOTE: a sign extension problem makes the attack easier with shorter strings.
41 CVE-2005-4718 DoS 2005-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
Opera 8.02 and earlier allows remote attackers to cause a denial of service (client crash) via (1) a crafted HTML file with a "content: url(0);" style attribute, a "bodyA" tag, a long string, and a "u" tag with a long attribute, as demonstrated by opera.html; and (2) a BGSOUND element with a "margin:-99;" STYLE attribute.
42 CVE-2005-4210 DoS 2005-12-13 2008-09-05
5.0
 None Remote Low Not required None None Partial
Opera before 8.51, when running on Windows with Input Method Editor (IME) installed, allows remote attackers to cause a denial of service (persistent application crash) by bookmarking a site with a long title.
43 CVE-2005-3946 20 DoS 2005-12-01 2008-09-05
5.0
 None Remote Low Not required None None Partial
Opera 8.50 allows remote attackers to cause a denial of service (crash) via a Java applet with a large string argument to the removeMember JNI method for the com.opera.JSObject class.
44 CVE-2005-3750 Exec Code 2005-11-22 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Opera before 8.51 on Linux and Unix systems allows remote attackers to execute arbitrary code via shell metacharacters (backticks) in a URL that another product provides in a command line argument when launching Opera.
45 CVE-2005-3699 2005-11-21 2008-09-05
5.0
 None Remote Low Not required None Partial None
Opera Web Browser 8.50 and 8.0 through 8.0.2 allows remote attackers to spoof the URL in the status bar via the title in an image in a link to a trusted site within a form to the malicious site.
46 CVE-2005-3059 2005-09-26 2008-09-05
10.0
 None Remote Low Not required Complete Complete Complete
Multiple unspecified vulnerabilities in Opera 8.50 on Linux and Windows have unknown impact and attack vectors, related to (1) " handling of must-revalidate cache directive for HTTPS pages" or (2) a "display issue with cookie comment encoding."
47 CVE-2005-3041 2005-09-22 2008-09-05
5.0
 None Remote Low Not required None Partial None
Unspecified "drag-and-drop vulnerability" in Opera Web Browser before 8.50 on Windows allows "unintentional file uploads."
48 CVE-2005-3007 2005-09-21 2008-09-05
2.6
 None Remote High Not required None Partial None
Opera before 8.50 allows remote attackers to spoof the content type of files via a filename with a trailing "." (dot), which might allow remote attackers to trick users into processing dangerous content.
49 CVE-2005-3006 2005-09-21 2008-09-05
5.0
 None Remote Low Not required None Partial None
The mail client in Opera before 8.50 opens attached files from the user's cache directory without warning the user, which might allow remote attackers to inject arbitrary web script and spoof attachment filenames.
50 CVE-2005-2407 Exec Code 2005-08-01 2010-08-18
2.6
 None Remote High Not required None Partial None
A design error in Opera 8.01 and earlier allows user-assisted attackers to execute arbitrary code by overlaying a malicious new window above a file download dialog box, then tricking the user into double-clicking on the "Run" button, aka "link hijacking".
Total number of vulnerabilities : 100   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritive source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritive source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritive source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.