CVE-2004-2570

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Opera before 7.54 allows remote attackers to modify properties and methods of the location object and execute Javascript to read arbitrary files from the client's local filesystem or display a false URL to the user.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0131.htmlBroken Link
http://osvdb.org/8331Broken Link
http://secunia.com/advisories/12233Broken Link, Patch, Vendor Advisory
http://www.gentoo.org/security/en/glsa/glsa-200408-05.xmlPatch, Third Party Advisory
http://www.greymagic.com/security/advisories/gm008-op/Broken Link, Exploit, Vendor Advisory
http://www.opera.com/docs/changelogs/windows/754/Broken Link, Patch
http://www.securityfocus.com/bid/10873Broken Link, Patch, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/16904Third Party Advisory, VDB Entry
http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0131.htmlBroken Link
http://osvdb.org/8331Broken Link
http://secunia.com/advisories/12233Broken Link, Patch, Vendor Advisory
http://www.gentoo.org/security/en/glsa/glsa-200408-05.xmlPatch, Third Party Advisory
http://www.greymagic.com/security/advisories/gm008-op/Broken Link, Exploit, Vendor Advisory
http://www.opera.com/docs/changelogs/windows/754/Broken Link, Patch
http://www.securityfocus.com/bid/10873Broken Link, Patch, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/16904Third Party Advisory, VDB Entry

Timeline

Published: Dec 31, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-25717.5Multiple buffer overflows in EnderUNIX isoqlog 2.1.1 allow remote attackers to execute arbitrary code via the (1) parseQmailFromBytesLine, (CVE-2004-25725.0AMAX Magic Winmail Server 3.6 allows remote attackers to obtain sensitive information by entering (1) invalid characters such as "()" or (2)CVE-2004-25737.5PHP remote file inclusion vulnerability in tables_update.inc.php in phpGroupWare 0.9.14.005 and earlier allows remote attackers to execute a CVE-2004-25744.3Cross-site scripting (XSS) vulnerability in index.php in phpGroupWare 0.9.14.005 and earlier allows remote attackers to inject arbitrary web CVE-2004-25755.0phpGroupWare 0.9.14.005 and earlier allow remote attackers to obtain sensitive information via a direct request to (1) hook_admin.inc.php, (CVE-2004-25765.0class.vfs_dav.inc.php in phpGroupWare 0.9.16.000 does not create .htaccess files to enable authorization checks for access to users' home-di CVE-2004-25775.0The acl_check function in phpGroupWare 0.9.16RC2 always returns True, even when mkdir does not behave as expected, which could allow remote CVE-2004-25785.0phpGroupWare before 0.9.16.002 transmits the (1) header admin and (2) setup passwords in plaintext via cookies, which allows remote attacker CVE-2004-25797.5ACLCHECK module in Novell iChain 2.3 allows attackers to bypass access control rules of an unspecified component via an unspecified attack v CVE-2004-25805.8Cross-site scripting (XSS) vulnerability in Novell iChain 2.3 allows remote attackers to obtain login credentials via unspecified vectors.CVE-2004-25815.0Novell iChain 2.3 allows attackers to cause a denial of service via a URL with a "specific string."CVE-2004-25825.0Novell iChain 2.3 includes the build number in the VIA line of the proxy server's HTTP headers, which allows remote attackers to obtain sens