CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-18913
https://notcve.org/view.php?id=CVE-2018-18913
21 Mar 2019 — Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP archive composed of an HTML page along with a malicious DLL to the target. Once the document is opened, it may allow the attacker to take full control of the system from any location within the system. The issue lies in the loading of the shcore.dll and dcomp.dll files: these files are being searched for by the program in the same system-wide directory where the HTML file is executed. Opera, en v... • https://blogs.opera.com/desktop/changelog-for-57 • CWE-426: Untrusted Search Path •
CVSS: 7.5EPSS: 0%CPEs: 64EXPL: 0CVE-2014-1870
https://notcve.org/view.php?id=CVE-2014-1870
06 Feb 2014 — Opera before 19 on Mac OS X allows user-assisted remote attackers to spoof the address bar via vectors involving a drag-and-drop operation. Opera anterior a 19 en Mac OS X permite a atacantes remotos asistidos por usuario falsificar la barra de direcciones a través de vectores que involucran operaciones drag-and-drop. • http://blogs.opera.com/security/2014/01/security-changes-features-opera-19 •
CVSS: 7.5EPSS: 0%CPEs: 63EXPL: 0CVE-2014-0815
https://notcve.org/view.php?id=CVE-2014-0815
06 Feb 2014 — The intent: URL implementation in Opera before 18 on Android allows attackers to read local files by leveraging an interaction error, as demonstrated by reading stored cookies. El "intent" de la implementación URL en Opera anterior a 18 en Android permite a atacantes leer archivos locales mediante el aprovechamiento de un error de interacción, tal como se ha demostrado mediante la lectura de cookies almacenadas. • http://blogs.opera.com/security/2014/01/security-changes-features-opera-19 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 174EXPL: 0CVE-2013-4705
https://notcve.org/view.php?id=CVE-2013-4705
13 Sep 2013 — Cross-site scripting (XSS) vulnerability in Opera before 15.00 allows remote attackers to inject arbitrary web script or HTML by leveraging UTF-8 encoding. Vulnerabilidad Cross-site scripting (XSS) en Opera anterior a v15.00 que permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarias aprovechamiento la codificación UTF-8. • http://jvn.jp/en/jp/JVN01094166/index.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 176EXPL: 0CVE-2013-3210
https://notcve.org/view.php?id=CVE-2013-3210
19 Apr 2013 — Opera before 12.15 does not properly block top-level domains in Set-Cookie headers, which allows remote attackers to obtain sensitive information by leveraging control of a different web site in the same top-level domain. Opera antes de v12.15 no bloquea adecuadamente dominios de nivel superior en los encabezados Set-Cookie, lo que permite a atacantes remotos obtener información sensible mediante el aprovechamiento de control de un sitio web diferente en el mismo dominio de nivel superior. • http://www.opera.com/docs/changelogs/unified/1215 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 0%CPEs: 173EXPL: 0CVE-2013-3211
https://notcve.org/view.php?id=CVE-2013-3211
19 Apr 2013 — Unspecified vulnerability in Opera before 12.15 has unknown impact and attack vectors, related to a "moderately severe issue." Vulnerabilidad no especificada en Opera antes de v12.15 tiene un impacto y vectores de ataque desconocidos, relacionado con un "problema de moderada severidad". • http://www.opera.com/docs/changelogs/unified/1215 •
CVSS: 5.9EPSS: 0%CPEs: 8EXPL: 0CVE-2013-1618 – Gentoo Linux Security Advisory 201406-14
https://notcve.org/view.php?id=CVE-2013-1618
08 Feb 2013 — The TLS implementation in Opera before 12.13 does not properly consider timing side-channel attacks on a MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169. La implementación de TLS en Opera antes de v12.13 no se tienen debidamente en cuenta tiempos de canal lateral, ataques a una operación de comprobació... • http://lists.opensuse.org/opensuse-updates/2013-02/msg00038.html • CWE-310: Cryptographic Issues •
CVSS: 9.8EPSS: 5%CPEs: 8EXPL: 0CVE-2013-1637 – Gentoo Linux Security Advisory 201406-14
https://notcve.org/view.php?id=CVE-2013-1637
08 Feb 2013 — Opera before 12.13 allows remote attackers to execute arbitrary code via vectors involving DOM events. Opera antes de 12.13 permite a atacantes remotos ejecutar código arbitrario a través de vectores relacionados con eventos DOM. Multiple vulnerabilities have been found in Opera, the worst of which may allow remote execution of arbitrary code. Versions less than 12.13_p1734 are affected. • http://lists.opensuse.org/opensuse-updates/2013-02/msg00038.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 30%CPEs: 8EXPL: 1CVE-2013-1638 – Opera SVG - Use-After-Free
https://notcve.org/view.php?id=CVE-2013-1638
08 Feb 2013 — Opera before 12.13 allows remote attackers to execute arbitrary code via crafted clipPaths in an SVG document. Opera antes de v12.13 permite a atacantes remotos ejecutar código a través de clipPaths diseñado en un documento SVG. Multiple vulnerabilities have been found in Opera, the worst of which may allow remote execution of arbitrary code. Versions less than 12.13_p1734 are affected. • https://www.exploit-db.com/exploits/24448 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2013-1639 – Gentoo Linux Security Advisory 201406-14
https://notcve.org/view.php?id=CVE-2013-1639
08 Feb 2013 — Opera before 12.13 does not send CORS preflight requests in all required cases, which allows remote attackers to bypass a CSRF protection mechanism via a crafted web site that triggers a CORS request. Opera anterior a v12.13 no envía las peticiones CORS del tipo "preflight" en todos los casos que se requiere, lo que permite a atacantes remotos evitar el mecanismo de protección CSRF a través de un un sitio web manipulado que provoca una petición CORS. Multiple vulnerabilities have been found in Opera, the wo... • http://lists.opensuse.org/opensuse-updates/2013-02/msg00038.html • CWE-352: Cross-Site Request Forgery (CSRF) •