CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6159
https://notcve.org/view.php?id=CVE-2020-6159
URLs using “javascript:” have the protocol removed when pasted into the address bar to protect users from cross-site scripting (XSS) attacks, but in certain circumstances this removal was not performed. This could allow users to be socially engineered to run an XSS attack against themselves. This vulnerability affects Opera for Android versions below 61.0.3076.56532. Las URL que usan "javascript:" tienen el protocolo removido cuando se pegaban en la barra de direcciones para proteger a usuarios de ataques de tipo cross-site scripting (XSS), pero en determinadas circunstancias esta eliminación no fue llevada a cabo. Esto podría permitir a usuarios hacer ingeniería social para ejecutar un ataque de tipo XSS contra ellos mismos. • https://security.opera.com/cross-site-scripting-in-ofa-opera-security-advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2019-12278
https://notcve.org/view.php?id=CVE-2019-12278
Opera through 53 on Android allows Address Bar Spoofing. Characters from several languages are displayed in Right-to-Left order, due to mishandling of several Unicode characters. The rendering mechanism, in conjunction with the "first strong character" concept, may improperly operate on a numerical IP address or an alphabetic string, leading to a spoofed URL. Opera versiones hasta 53 en Android, permite una Suplantación de la Barra de Direcciones. Los caracteres de varios idiomas son desplegados en orden de derecha a izquierda, debido al manejo inapropiado de varios caracteres Unicode. • https://help.opera.com/en/latest/security-and-privacy https://medium.com/bugbountywriteup/opera-android-address-bar-spoofing-cve-2019-12278-9ffcfd6c508c •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-19788
https://notcve.org/view.php?id=CVE-2019-19788
Opera for Android before 54.0.2669.49432 is vulnerable to a sandboxed cross-origin iframe bypass attack. By using a service working inside a sandboxed iframe it is possible to bypass the normal sandboxing attributes. This allows an attacker to make forced redirections without any user interaction from a third-party context. Opera para Android versiones anteriores a 54.0.2669.49432, es vulnerable a un ataque de omisión de iframe de origen cruzado dentro del sandbox. Al utilizar un servicio que funciona dentro de un iframe del sandbox, es posible omitir los atributos normales del sandbox. • https://security.opera.com/bypass-a-restriction-in-ofa-54-opera-security-advisories •