CVE-2008-4696

50Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 46%

from disclosure to weapon0 days

Published on NVDOct 23

1st PoCOct 23

metasploitOct 23

exploitation probability

46%top 1% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

Cross-site scripting (XSS) vulnerability in Opera.dll in Opera before 9.61 allows remote attackers to inject arbitrary web script or HTML via the anchor identifier (aka the "optional fragment"), which is not properly escaped before storage in the History Search database (aka md.dat).

Affected products

n/a · n/a

public PoCs found — 3

exploitdbwww.exploit-db.com/exploits/9944unverified exploitdbwww.exploit-db.com/exploits/16304unverified cve_referencewww.exploit-db.com/exploits/6801unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00009.html http://secunia.com/advisories/32299 http://secunia.com/advisories/32394 http://secunia.com/advisories/32538 http://security.gentoo.org/glsa/glsa-200811-01.xml http://securityreason.com/securityalert/4504 https://exchange.xforce.ibmcloud.com/vulnerabilities/46003 https://www.exploit-db.com/exploits/6801 http://www.openwall.com/lists/oss-security/2008/10/21/6 http://www.openwall.com/lists/oss-security/2008/10/22/5 http://www.opera.com/docs/changelogs/freebsd/961/http://www.opera.com/docs/changelogs/linux/961/