OB
Product
Opera Browser
282
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 3Medium 4Low 1
Watch
Add Opera Browser to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2010-1993 | – | May 20 | Opera 9.52 does not properly handle an IFRAME element with a mailto: URL in its SRC attribute, which allows remote attackers to cause a denial of service (resource consumption)… Affected: 9.52 |
| CVE-2010-1989 | – | May 20 | Opera 9.52 executes a mail application in situations where an IMG element has a SRC attribute that is a redirect to a mailto: URL, which allows remote attackers to cause a denial… Affected: 9.52 |
| CVE-2010-1728 | – | May 6 | Opera before 10.53 on Windows and Mac OS X does not properly handle a series of document modifications that occur asynchronously, which allows remote attackers to execute… Affected: through 10.52; 5.0; 5.0; 5.0; 5.0; 5.0; +34 more |
| CVE-2010-1349 | – | Apr 12 | Integer overflow in Opera 10.10 through 10.50 allows remote attackers to execute arbitrary code via a large Content-Length value, which triggers a heap overflow Affected: 10.10; 10.50; 10.50; 10.50 |
| CVE-2010-1310 | – | Apr 8 | Opera 10.50 allows remote attackers to obtain sensitive information via crafted XSLT constructs, which cause Opera to return cached contents of other pages Affected: 10.50 |
| CVE-2010-0653 | – | Feb 18 | Opera before 10.10 permits cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed, which… Affected: All versions, or not specified |
| CVE-2009-4072 | – | Nov 24 | Unspecified vulnerability in Opera before 10.10 has unknown impact and attack vectors, related to a "moderately severe issue." Affected: through 10.10; 7.0; 7.23; 7.53; 7.54; 7.60; +22 more |
| CVE-2009-4071 | – | Nov 24 | Opera before 10.10, when exception stacktraces are enabled, places scripting error messages from a web site into variables that can be read by a different web site, which allows… Affected: through 10.10; 7.0; 7.23; 7.53; 7.54; 7.60; +23 more |
| CVE-2009-3832 | – | Oct 30 | Opera before 10.01 on Windows does not prevent use of Web fonts in rendering the product's own user interface, which allows remote attackers to spoof the address field via a… Affected: before 10.01 |
| CVE-2009-3831 | – | Oct 30 | Opera before 10.01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted domain name Affected: before 10.01 |
| CVE-2009-3269 | – | Sep 18 | Opera 9.52 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a series of automatic submissions of a form containing a KEYGEN element, a… Affected: through 9.52; 1.00; 2.00; 2.10; 2.10; 2.10; +34 more |
| CVE-2009-3266 | – | Sep 18 | Opera before 10.01 does not properly restrict HTML in a (1) RSS or (2) Atom feed, which allows remote attackers to conduct cross-site scripting (XSS) attacks, and conduct… Affected: 5.0; 5.0; 5.0; 5.0; 5.0; 5.0; +34 more |
| CVE-2009-3265 | – | Sep 18 | Cross-site scripting (XSS) vulnerability in Opera 9 and 10 allows remote attackers to inject arbitrary web script or HTML via a (1) RSS or (2) Atom feed, related to the rendering… Affected: 9.0; 10.00 |
| CVE-2008-7245 | – | Sep 18 | Opera 9.52 and earlier allows remote attackers to cause a denial of service (unusable browser) by calling the window.print function in a loop, aka a "printing DoS attack,"… Affected: through 9.52; 5.0; 5.0; 5.0; 5.0; 5.0; +34 more |
| CVE-2009-3049 | – | Sep 2 | Opera before 10.00 does not properly display all characters in Internationalized Domain Names (IDN) in the address bar, which allows remote attackers to spoof URLs and conduct… Affected: through 10.00; 7.0; 7.23; 7.53; 7.54; 7.60; +19 more |
| CVE-2009-3048 | – | Sep 2 | Opera before 10.00 on Linux, Solaris, and FreeBSD does not properly implement the "INPUT TYPE=file" functionality, which allows remote attackers to trick a user into uploading an… Affected: through 10.00; 1.00; 2.00; 2.10; 2.10; 2.10; +34 more |
| CVE-2009-3047 | – | Sep 2 | Opera before 10.00, when a collapsed address bar is used, does not properly update the domain name from the previously visited site to the currently visited site, which might… Affected: through 10.00; 7.0; 7.23; 7.53; 7.54; 7.60; +19 more |
| CVE-2009-3045 | – | Sep 2 | Opera before 10.00 trusts root X.509 certificates signed with the MD2 algorithm, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted… Affected: through 10.00; 7.0; 7.23; 7.53; 7.54; 7.60; +19 more |
| CVE-2009-3044 | – | Sep 2 | Opera before 10.00 does not properly handle a (1) '\0' character or (2) invalid wildcard character in a domain name in the subject's Common Name (CN) field of an X.509… Affected: through 10.00; 1.00; 2.00; 2.10; 2.10; 2.10; +34 more |
| CVE-2009-3013 | – | Aug 31 | Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site… Affected: through 9.52; 7.0; 7.23; 7.53; 7.54; 7.60; +18 more |
| CVE-2009-2577 | – | Jul 22 | Opera 9.52 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption, and application hang) via a long Unicode string argument to the write… Affected: through 9.52; 7.0; 7.23; 7.53; 7.54; 7.60; +17 more |
| CVE-2009-2540 | – | Jul 20 | Opera, possibly 9.64 and earlier, allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object, a… Affected: through 9.64 |
| CVE-2009-2351 | – | Jul 7 | Opera 9.52 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via… Affected: through 9.52; 7.0; 7.23; 7.53; 7.54; 7.60; +18 more |
| CVE-2009-2070 | – | Jun 15 | Opera displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an arbitrary https… Affected: All versions, or not specified |
| CVE-2009-2067 | – | Jun 15 | Opera detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https… Affected: through 9.22; 7.0; 7.23; 7.53; 7.54; 7.60; +15 more |
| CVE-2009-2063 | – | Jun 15 | Opera, possibly before 9.25, processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in… Affected: through 9.24; 1.00; 2.00; 2.10; 2.10; 2.10; +34 more |
| CVE-2009-2059 | – | Jun 15 | Opera, possibly before 9.25, uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows… Affected: through 9.22; 7.0; 7.23; 7.53; 7.54; 7.60; +15 more |
| CVE-2009-1599 | – | May 11 | Opera executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline PDF file, which might allow remote… Affected: All versions, or not specified |
| CVE-2009-1234 | – | Apr 2 | Opera 9.64 allows remote attackers to cause a denial of service (application crash) via an XML document containing a long series of start-tags with no corresponding end-tags Affected: 9.52; 9.64 |
| CVE-2009-0916 | – | Mar 16 | Unspecified vulnerability in Opera before 9.64 has unknown impact and attack vectors, related to a "moderately severe issue." Affected: through 9.63; 1.00; 2.00; 2.10; 2.10; 2.10; +34 more |
| CVE-2009-0915 | – | Mar 16 | Opera before 9.64 allows remote attackers to conduct cross-domain scripting attacks via unspecified vectors related to plug-ins Affected: before 9.64 |
| CVE-2009-0914 | – | Mar 16 | Opera before 9.64 allows remote attackers to execute arbitrary code via a crafted JPEG image that triggers memory corruption Affected: through 9.63; 1.00; 2.00; 2.10; 2.10; 2.10; +34 more |
| CVE-2008-5683 | – | Dec 19 | Unspecified vulnerability in Opera before 9.63 allows remote attackers to "reveal random data" via unknown vectors Affected: through 9.62; 1.00; 2.00; 2.10; 2.10; 2.10; +34 more |
| CVE-2008-5682 | – | Dec 19 | Cross-site scripting (XSS) vulnerability in Opera before 9.63 allows remote attackers to inject arbitrary web script or HTML via built-in XSLT templates Affected: through 9.62; 1.00; 2.00; 2.10; 2.10; 2.10; +34 more |
| CVE-2008-5681 | – | Dec 19 | Opera before 9.63 does not block unspecified "scripted URLs" during the feed preview, which allows remote attackers to read existing subscriptions and force subscriptions to… Affected: through 9.62; 1.00; 2.00; 2.10; 2.10; 2.10; +34 more |
| CVE-2008-5680 | – | Dec 19 | Multiple buffer overflows in Opera before 9.63 might allow (1) remote attackers to execute arbitrary code via a crafted text area, or allow (2) user-assisted remote attackers to… Affected: through 9.62; 1.00; 2.00; 2.10; 2.10; 2.10; +34 more |
| CVE-2008-4725 | – | Oct 23 | Cross-site scripting (XSS) vulnerability in Opera.dll in Opera 9.52 allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly… Affected: 9.52 |
| CVE-2008-4698 | – | Oct 23 | Opera before 9.61 does not properly block scripts during preview of a news feed, which allows remote attackers to create arbitrary new feed subscriptions and read the contents of… Affected: through 9.60; 5.0; 5.0; 5.0; 5.0; 5.0; +34 more |
| CVE-2008-4697 | – | Oct 23 | The Fast Forward feature in Opera before 9.61, when a page is located in a frame, executes a javascript: URL in the context of the outermost page instead of the page that contains… Affected: through 9.60; 5.0; 5.0; 5.0; 5.0; 5.0; +34 more |
| CVE-2008-4694 | – | Oct 23 | Unspecified vulnerability in Opera before 9.60 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a redirect that specifies a… Affected: through 9.60; 5.0; 5.0; 5.0; 5.0; 5.0; +34 more |
| CVE-2008-4292 | – | Sep 27 | Opera before 9.52 does not check the CRL override upon encountering a certificate that lacks a CRL, which has unknown impact and attack vectors Affected: through 9.51; 5.0; 5.0; 5.0; 5.0; 5.0; +34 more |
| CVE-2008-4200 | – | Sep 27 | Opera before 9.52 does not ensure that the address field of a news feed represents the feed's actual URL, which allows remote attackers to change this field to display the URL of… Affected: through 9.51; 5.0; 5.0; 5.0; 5.0; 5.0; +34 more |
| CVE-2008-4199 | – | Sep 27 | Opera before 9.52 does not prevent use of links from web pages to feed source files on the local disk, which might allow remote attackers to determine the validity of local… Affected: through 9.51; 5.0; 5.0; 5.0; 5.0; 5.0; +34 more |
| CVE-2008-4198 | – | Sep 27 | Opera before 9.52, when rendering an http page that has loaded an https page into a frame, displays a padlock icon and offers a security information dialog reporting a secure… Affected: through 9.51; 5.0; 5.0; 5.0; 5.0; 5.0; +34 more |
| CVE-2008-4196 | – | Sep 27 | Cross-site scripting (XSS) vulnerability in Opera before 9.52 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 9.51; 5.0; 5.0; 5.0; 5.0; 5.0; +34 more |
| CVE-2008-4195 | – | Sep 27 | Opera before 9.52 does not properly restrict the ability of a framed web page to change the address associated with a different frame, which allows remote attackers to trigger the… Affected: through 9.51; 5.0; 5.0; 5.0; 5.0; 5.0; +34 more |
| CVE-2008-3078 | – | Jul 9 | Opera before 9.51 does not properly manage memory within functions supporting the CANVAS element, which allows remote attackers to read uninitialized memory contents by using… Affected: through 9.50; 1.00; 2.00; 2.10; 2.10; 2.10; +34 more |
| CVE-2008-2714 | – | Jun 16 | Opera before 9.26 allows remote attackers to misrepresent web page addresses using "certain characters" that "cause the page address text to be misplaced." Affected: through 9.25; 1.00; 2.00; 2.10; 2.10; 2.10; +34 more |
| CVE-2008-2716 | – | Jun 16 | Unspecified vulnerability in Opera before 9.5 allows remote attackers to spoof the contents of trusted frames on the same parent page by modifying the location, which can… Affected: before 9.5 |
| CVE-2008-2715 | – | Jun 16 | Unspecified vulnerability in Opera before 9.5 allows remote attackers to read cross-domain images via HTML CANVAS elements that use the images as patterns Affected: through 9.50; 1.00; 2.00; 2.10; 2.10; 2.10; +34 more |