CVEvulnerability
CVE-2008-4696
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-10-23
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in Opera.dll in Opera before 9.61 allows remote attackers to inject arbitrary web script or HTML via the anchor identifier (aka the "optional fragment"), which is not properly escaped before storage in the History Search database (aka md.dat).
Affected configurations
• opera opera
• opera opera (<= 9.6)
• opera opera 5..10
• opera opera 5.0
• opera opera 5.1
• opera opera 5.2
• opera opera 5.3
• opera opera 5.4
• opera opera 5.5
• opera opera 5.6
• opera opera 5.7
• opera opera 5.8
• opera opera 5.9
• opera opera 5.11
• opera opera 5.12
• opera opera 6
• opera opera 6.0
• opera opera 6.01
• opera opera 6.02
• opera opera 6.03
• opera opera 6.04
• opera opera 6.05
• opera opera 6.06
• opera opera 7
• opera opera 7.0
• opera opera 7.01
• opera opera 7.02
• opera opera 7.03
• opera opera 7.10
• opera opera 7.11
• opera opera 7.20
• opera opera 7.21
• opera opera 7.22
• opera opera 7.23
• opera opera 7.50
• opera opera 7.51
• opera opera 7.52
• opera opera 7.53
• opera opera 7.54
• opera opera 8.0
• opera opera 8.01
• opera opera 8.02
• opera opera 8.50
• opera opera 8.51
• opera opera 8.52
• opera opera 8.53
• opera opera 8.54
• opera opera 9.0
• opera opera 9.01
• opera opera 9.02
• opera opera 9.10
• opera opera 9.20
• opera opera 9.21
• opera opera 9.22
• opera opera 9.23
• opera opera 9.24
• opera opera 9.25
• opera opera 9.26
• opera opera 9.27
• opera opera 9.50
… and 1 more
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00009.html lists.opensuse.org
- http://secunia.com/advisories/32299 Vendor Advisory
- http://secunia.com/advisories/32394 secunia.com
- http://secunia.com/advisories/32538 secunia.com
- http://security.gentoo.org/glsa/glsa-200811-01.xml security.gentoo.org
- http://securityreason.com/securityalert/4504 securityreason.com
- http://www.openwall.com/lists/oss-security/2008/10/21/6 www.openwall.com
- http://www.openwall.com/lists/oss-security/2008/10/22/5 www.openwall.com
- http://www.opera.com/docs/changelogs/freebsd/961/ Patch
- http://www.opera.com/docs/changelogs/linux/961/ Patch
- http://www.opera.com/docs/changelogs/mac/961/ Patch
- http://www.opera.com/docs/changelogs/solaris/961/ www.opera.com
- http://www.opera.com/docs/changelogs/windows/961/ www.opera.com
- http://www.opera.com/support/search/view/903/ Vendor Advisory
- http://www.security-assessment.com/files/advisories/2008-10-22_Opera_Stored_Cross_Site_Scripting.pdf www.security-assessment.com
- http://www.securityfocus.com/archive/1/497646/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/31869 Exploit, Patch
- http://www.vupen.com/english/advisories/2008/2873 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46003 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/6801 www.exploit-db.com
- http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00009.html lists.opensuse.org
- http://secunia.com/advisories/32299 Vendor Advisory
- http://secunia.com/advisories/32394 secunia.com
- http://secunia.com/advisories/32538 secunia.com
- http://security.gentoo.org/glsa/glsa-200811-01.xml security.gentoo.org
- http://securityreason.com/securityalert/4504 securityreason.com
- http://www.openwall.com/lists/oss-security/2008/10/21/6 www.openwall.com
- http://www.openwall.com/lists/oss-security/2008/10/22/5 www.openwall.com
- http://www.opera.com/docs/changelogs/freebsd/961/ Patch
- http://www.opera.com/docs/changelogs/linux/961/ Patch
- http://www.opera.com/docs/changelogs/mac/961/ Patch
- http://www.opera.com/docs/changelogs/solaris/961/ www.opera.com
- http://www.opera.com/docs/changelogs/windows/961/ www.opera.com
- http://www.opera.com/support/search/view/903/ Vendor Advisory
- http://www.security-assessment.com/files/advisories/2008-10-22_Opera_Stored_Cross_Site_Scripting.pdf www.security-assessment.com
- http://www.securityfocus.com/archive/1/497646/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/31869 Exploit, Patch
- http://www.vupen.com/english/advisories/2008/2873 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46003 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/6801 www.exploit-db.com