First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2012-6464

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in Opera before 12.10 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript code that overrides methods of unspecified native objects in documents that have different origins.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.opera.com/docs/changelogs/unified/1210/
http://www.opera.com/support/kb/view/1032/Vendor Advisory
http://www.opera.com/docs/changelogs/unified/1210/
http://www.opera.com/support/kb/view/1032/Vendor Advisory

Timeline

Published: Jan 2, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-64659.3Opera before 12.10 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a malformed SVG im CVE-2012-64665.0Opera before 12.10 does not properly handle incorrect size data in a WebP image, which allows remote attackers to obtain potentially sensiti CVE-2012-64674.3Opera before 12.10 follows Internet shortcuts that are referenced by a (1) IMG element or (2) other inline element, which makes it easier fo CVE-2012-64689.3Heap-based buffer overflow in Opera before 12.11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corr CVE-2012-64695.0Opera before 12.11 allows remote attackers to determine the existence of arbitrary local files via vectors involving web script in an error CVE-2012-64709.3Opera before 12.12 does not properly allocate memory for GIF images, which allows remote attackers to execute arbitrary code or cause a deni CVE-2012-64715.0Opera before 12.12 allows remote attackers to spoof the address field via a high rate of HTTP requests.CVE-2012-64724.6Opera before 12.12 on UNIX uses weak permissions for the profile directory, which allows local users to obtain sensitive information by read CVE-2012-64936.8Cross-site request forgery (CSRF) vulnerability in Rapid7 Nexpose Security Console before 5.5.4 allows remote attackers to hijack the authen CVE-2012-64946.1Rapid7 Nexpose before 5.5.4 contains a session hijacking vulnerability which allows remote attackers to capture a user's session and gain un CVE-2012-64956.0Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions CVE-2012-64967.5SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allow