Opera before 10.63 does not ensure that the portion of a URL shown in the Address Bar contains the beginning of the URL, which allows remote attackers to spoof URLs by changing a window's size.

The remote host is running the Opera web browser.

Versions of Opera earlier than 10.63 are potentially affected by multiple vulnerabilities :

  - It is possible to bypass cross-domain checks, and allow partial data theft by using CSS. (971)

  - It is possible to spoof the page address by modifying the size of the browser window. (972)

  - Carefully timed reloads and redirects could allow spoofing and cross-site scripting attacks.  Using this XSS vector it may be possible to modify Opera's configuration, which could allow arbitrary code execution on the remote system. (973)

  - It is possible to intercept private video streams. (974)

  - An error while displaying invalid URL's could allow cross-site scripting attacks. (976)

The remote host is running the Opera web browser. Versions of Opera earlier than 10.63 are potentially affected by multiple vulnerabilities :

 - It is possible to bypass cross-domain checks, and allow partial data theft by using CSS. (971)
 - It is possible to spoof the page address by modifying the size of the browser window. (972)
 - Carefully timed reloads and redirects could allow spoofing and cross-site scripting attacks.  Using this XSS vector it may be possible to modify Opera's configuration, which could allow arbitrary code execution on the remote system. (973)
 - It is possible to intercept private video streams. (974)
 - An error while displaying invalid URL's could allow cross-site scripting attacks. (976)

The version of Opera installed on the remote host is prior to 10.63.
It is, therefore, affected by the multiple vulnerabilities :

  - It is possible to bypass cross-domain checks and allow     partial data theft by using CSS. (971)

  - It is possible to spoof the page address by modifying     the size of the browser window. (972)

  - Carefully timed reloads and redirects allow spoofing and     cross-site scripting attacks. Using this XSS vector i      may be possible to modify Opera's configuration, which      could allow arbitrary code execution on the remote      system. (973)

  - It is possible to intercept private video streams.
    (974)

  - An error while displaying invalid URLs allows cross-site     scripting attacks. (976)

  - It's possible to crash the application and cause a     denial of service condition when saving a file while the     page redirects, when viewing a Flash movie with a     transparent Window Mode (wmode) property, or when SVG     exists in an '<img>' element.

ID	Name	Product	Family	Severity
800852	Opera < 10.63 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
5678	Opera < 10.63 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
49964	Opera < 10.63 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2010-4044

high

Tenable Plugins

high

medium

high