CVE-2010-2661

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Opera before 10.54 on Windows and Mac OS X, and before 10.60 on UNIX platforms, does not properly restrict access to the full pathname of a file selected for upload, which allows remote attackers to obtain potentially sensitive information via unspecified DOM manipulations.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-264

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Jul 8, 2010
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2010

CVE-2010-26624.3Opera before 10.60 allows remote attackers to bypass the popup blocker via a javascript: URL and a "fake click."CVE-2010-26634.3Opera before 10.60 allows remote attackers to cause a denial of service (application hang) via an ended event handler that changes the SRC aCVE-2010-26644.3Opera before 10.60 allows remote attackers to cause a denial of service (application hang) via certain HTML content that has an unclosed SPACVE-2010-26654.3Cross-site scripting (XSS) vulnerability in Opera before 10.54 on Windows and Mac OS X, and before 10.11 on UNIX platforms, allows remote atCVE-2010-26669.3Opera before 10.54 on Windows and Mac OS X does not properly enforce permission requirements for widget filesystem access and directory seleCVE-2010-26676.0Multiple unspecified vulnerabilities in the Virtual Appliance Management Infrastructure (VAMI) in VMware Studio 2.0 allow remote authenticatCVE-2010-26686.4Unspecified vulnerability in Adaptive Micro Systems ALPHA Ethernet Adapter II Web-Manager 3.40.2 allows remote attackers to bypass authenticCVE-2010-26694.3Cross-site scripting (XSS) vulnerability in admin/editors/text/editor-body.php in Orbis CMS 1.0.2 allows remote attackers to inject arbitrarCVE-2010-26707.5SQL injection vulnerability in recipedetail.php in BrotherScripts Recipe Website allows remote attackers to execute arbitrary SQL commands vCVE-2010-26714.3Cross-site scripting (XSS) vulnerability in advancedsearch.php in eZ Publish 3.7.0 through 4.2.0 allows remote attackers to inject arbitraryCVE-2010-26727.5Multiple SQL injection vulnerabilities in eZ Publish 3.7.0 through 4.2.0 allow remote attackers to execute arbitrary SQL commands via the (1CVE-2010-26737.5SQL injection vulnerability in profile_view.php in Devana 1.6.6 and earlier allows remote attackers to execute arbitrary SQL commands via th
CVE-2010-2661: Medium severity, CVSS 4.3 | Vulnix