Total vulnerabilities in the database
Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Location header that contains JavaScript sequences in a data:text/html URI or (2) entering a data:text/html URI with JavaScript sequences when specifying the content of a Location header. NOTE: the JavaScript executes outside of the context of the HTTP site.
| Software | From | Fixed in |
|---|---|---|
| opera / opera_browser | 7.23 | 7.23.x |
| opera / opera_browser | 9.02 | 9.02.x |
| opera / opera_browser | 7.53 | 7.53.x |
| opera / opera_browser | 8.50 | 8.50.x |
| opera / opera_browser | 9.51 | 9.51.x |
| opera / opera_browser | 8.53 | 8.53.x |
| opera / opera_browser | 9.12 | 9.12.x |
| opera / opera_browser | 8.0 | 8.0.x |
| opera / opera_browser | - | 9.52.x |
| opera / opera_browser | 8.54 | 8.54.x |
| opera / opera_browser | 8.02 | 8.02.x |
| opera / opera_browser | 9.20 | 9.20.x |
| opera / opera_browser | 9.21 | 9.21.x |
| opera / opera_browser | 8.51 | 8.51.x |
| opera / opera_browser | 7.60 | 7.60.x |
| opera / opera_browser | 7.54 | 7.54.x |
| opera / opera_browser | 9.22 | 9.22.x |
| opera / opera_browser | 9.01 | 9.01.x |
| opera / opera_browser | 9.0 | 9.0.x |
| opera / opera_browser | 9.10 | 9.10.x |
| opera / opera_browser | 8.52 | 8.52.x |
| opera / opera_browser | 10.00-beta_3 | 10.00-beta_3.x |
| opera / opera_browser | 8.01 | 8.01.x |
| opera / opera_browser | 7.0 | 7.0.x |