CVE-2010-2658

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Opera before 10.60 does not properly restrict certain interaction between plug-ins, file inputs, and the clipboard, which allows user-assisted remote attackers to trigger the uploading of arbitrary files via a crafted web site.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/40375Vendor Advisory
http://www.opera.com/docs/changelogs/mac/1060/
http://www.opera.com/docs/changelogs/unix/1060/
http://www.opera.com/docs/changelogs/windows/1060/
http://www.opera.com/support/search/view/958/Vendor Advisory
http://www.vupen.com/english/advisories/2010/1664Patch, Vendor Advisory
http://www.vupen.com/english/advisories/2010/1673Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11862
http://secunia.com/advisories/40375Vendor Advisory
http://www.opera.com/docs/changelogs/mac/1060/
http://www.opera.com/docs/changelogs/unix/1060/
http://www.opera.com/docs/changelogs/windows/1060/
http://www.opera.com/support/search/view/958/Vendor Advisory
http://www.vupen.com/english/advisories/2010/1664Patch, Vendor Advisory
http://www.vupen.com/english/advisories/2010/1673Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11862

Timeline

Published: Jul 8, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-26594.3Opera before 10.50 on Windows, before 10.52 on Mac OS X, and before 10.60 on UNIX platforms makes widget properties accessible to third-part CVE-2010-26604.3Opera before 10.54 on Windows and Mac OS X, and before 10.60 on UNIX platforms, does not properly restrict certain uses of homograph charact CVE-2010-26614.3Opera before 10.54 on Windows and Mac OS X, and before 10.60 on UNIX platforms, does not properly restrict access to the full pathname of a CVE-2010-26624.3Opera before 10.60 allows remote attackers to bypass the popup blocker via a javascript: URL and a "fake click."CVE-2010-26634.3Opera before 10.60 allows remote attackers to cause a denial of service (application hang) via an ended event handler that changes the SRC a CVE-2010-26644.3Opera before 10.60 allows remote attackers to cause a denial of service (application hang) via certain HTML content that has an unclosed SPA CVE-2010-26654.3Cross-site scripting (XSS) vulnerability in Opera before 10.54 on Windows and Mac OS X, and before 10.11 on UNIX platforms, allows remote at CVE-2010-26669.3Opera before 10.54 on Windows and Mac OS X does not properly enforce permission requirements for widget filesystem access and directory sele CVE-2010-26676.0Multiple unspecified vulnerabilities in the Virtual Appliance Management Infrastructure (VAMI) in VMware Studio 2.0 allow remote authenticat CVE-2010-26686.4Unspecified vulnerability in Adaptive Micro Systems ALPHA Ethernet Adapter II Web-Manager 3.40.2 allows remote attackers to bypass authentic CVE-2010-26694.3Cross-site scripting (XSS) vulnerability in admin/editors/text/editor-body.php in Orbis CMS 1.0.2 allows remote attackers to inject arbitrar CVE-2010-26707.5SQL injection vulnerability in recipedetail.php in BrotherScripts Recipe Website allows remote attackers to execute arbitrary SQL commands v