| CVE-2007-6523 | CAO7.8 | Algorithmic complexity vulnerability in Opera 9.50 beta and 9.x before 9.25 allows remote attackers to cause a denial of service (CPU consumption) via a crafted bitmap (BMP) file that triggers a large number of calculations and checks. | 24/12/2007 |
| CVE-2007-6522 | TRUNG BÌNH4.3 | The rich text editing functionality in Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks by using designMode to modify contents of pages in other domains. | 24/12/2007 |
| CVE-2007-6521 | NGHIÊM TRỌNG10.0 | Unspecified vulnerability in Opera before 9.25 allows remote attackers to execute arbitrary code via crafted TLS certificates. | 24/12/2007 |
| CVE-2007-6520 | TRUNG BÌNH4.3 | Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks via unknown vectors related to plug-ins. | 24/12/2007 |
| CVE-2007-5541 | NGHIÊM TRỌNG9.3 | Unspecified vulnerability in Opera before 9.24, when using an "external" newsgroup or e-mail client, allows remote attackers to execute arbitrary commands via unknown vectors. | 18/10/2007 |
| CVE-2007-5540 | CAO7.5 | Unspecified vulnerability in Opera before 9.24 allows remote attackers to overwrite functions on pages from other domains and bypass the same-origin policy via unknown vectors. | 18/10/2007 |
| CVE-2007-5476 | NGHIÊM TRỌNG10.0 | Unspecified vulnerability in Adobe Flash Player 9.0.47.0 and earlier, when running on Opera before 9.24 on Mac OS X, has unknown "Highly Severe" impact and unknown attack vectors. | 18/10/2007 |
| CVE-2007-5276 | TRUNG BÌNH4.3 | Opera 9 drops DNS pins based on failed connections to irrelevant TCP ports, which makes it easier for remote attackers to conduct DNS rebinding attacks, as demonstrated by a port 81 URL in an IMG SRC, when the DNS pin had been established for a session on port 80. | 08/10/2007 |
| CVE-2007-4944 | TRUNG BÌNH5.0 | The canvas.createPattern function in Opera 9.x before 9.22 for Linux, FreeBSD, and Solaris does not clear memory before using it to process a new pattern, which allows remote attackers to obtain sensitive information (memory contents) via JavaScript. | 18/09/2007 |
| CVE-2007-4367 | NGHIÊM TRỌNG9.3 | Opera before 9.23 allows remote attackers to execute arbitrary code via crafted Javascript that triggers a "virtual function call on an invalid pointer." | 15/08/2007 |
| CVE-2007-3929 | NGHIÊM TRỌNG9.3 | Use-after-free vulnerability in the BitTorrent support in Opera before 9.22 allows user-assisted remote attackers to execute arbitrary code via a crafted header in a torrent file, which leaves a dangling pointer to an invalid object. | 21/07/2007 |
| CVE-2007-3819 | TRUNG BÌNH5.0 | Opera 9.21 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed. | 17/07/2007 |
| CVE-2007-3142 | TRUNG BÌNH5.8 | Visual truncation vulnerability in Opera 9.21 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a long hostname, which is truncated after 34 characters, as demonstrated by a phishing attack using HTTP Basic Authentication. | 11/06/2007 |
| CVE-2007-2809 | NGHIÊM TRỌNG9.3 | Buffer overflow in the transfer manager in Opera before 9.21 for Windows allows user-assisted remote attackers to execute arbitrary code via a crafted torrent file. NOTE: due to the lack of details, it is not clear if this is the same issue as CVE-2007-2274. | 22/05/2007 |
| CVE-2007-2274 | CAO7.8 | The BitTorrent implementation in Opera 9.2 allows remote attackers to cause a denial of service (CPU consumption and application crash) via a malformed torrent file. NOTE: the original disclosure refers to this as a memory leak, but it is not certain. | 25/04/2007 |
| CVE-2007-2022 | TRUNG BÌNH6.8 | Adobe Macromedia Flash Player 7 and 9, when used with Opera before 9.20 or Konqueror before 20070613, allows remote attackers to obtain sensitive information (browser keystrokes), which are leaked to the Flash Player applet. | 13/04/2007 |
| CVE-2007-1737 | CAO7.5 | Opera 9.10 does not check URLs embedded in (1) object or (2) iframe HTML tags against the phishing site blacklist, which allows remote attackers to bypass phishing protection. | 28/03/2007 |
| CVE-2007-1563 | TRUNG BÌNH6.8 | The FTP protocol implementation in Opera 9.10 allows remote attackers to allows remote servers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response. | 21/03/2007 |
| CVE-2007-1377 | TRUNG BÌNH5.0 | AcroPDF.DLL in Adobe Reader 8.0, when accessed from Mozilla Firefox, Netscape, or Opera, allows remote attackers to cause a denial of service (unspecified resource consumption) via a .pdf URL with an anchor identifier that begins with search= followed by many %n sequences, a different vulnerability than CVE-2006-6027 a | 10/03/2007 |
| CVE-2007-1115 | TRUNG BÌNH4.3 | The child frames in Opera 9 before 9.20 inherit the default charset from the parent window when a charset is not specified in an HTTP Content-Type header or META tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set. | 26/02/2007 |