CVE-2008-4725

Cross-site scripting (XSS) vulnerability in Opera.dll in Opera 9.52 allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly escaped before storage in the History Search database (aka md.dat), a different vector than CVE-2008-4696. NOTE: some of these issues were addressed before 9.60.

Link	Resource
http://www.opera.com/docs/changelogs/windows/961/
http://www.opera.com/docs/changelogs/mac/961/
http://www.securityfocus.com/bid/31869	Exploit
http://www.opera.com/docs/changelogs/linux/961/
http://www.openwall.com/lists/oss-security/2008/10/22/5
http://www.openwall.com/lists/oss-security/2008/10/21/6
http://www.opera.com/docs/changelogs/solaris/961/
http://www.security-assessment.com/files/advisories/2008-10-22_Opera_Stored_Cross_Site_Scripting.pdf
http://secunia.com/advisories/32299	Vendor Advisory
http://www.opera.com/docs/changelogs/freebsd/961/
http://securityreason.com/securityalert/4504
http://www.vupen.com/english/advisories/2008/2873
http://www.opera.com/support/search/view/903/
https://exchange.xforce.ibmcloud.com/vulnerabilities/46231
https://exchange.xforce.ibmcloud.com/vulnerabilities/46003
https://www.exploit-db.com/exploits/6801
http://www.securityfocus.com/archive/1/497646/100/0/threaded

Configuration 1

cpe:2.3:a:opera:opera_browser:9.52:*:*:*:*:*:*:*

---

Published : 2008-10-23 10:00

Updated : 2018-10-11 08:52

---

NVD link : CVE-2008-4725

Mitre link : CVE-2008-4725

No products.

CWE-79