Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The mail client in Opera before 8.50 opens attached files from the user's cache directory without warning the user, which might allow remote attackers to inject arbitrary web script and spoof attachment filenames.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Opera Mail客户端附件欺骗和脚本注入漏洞
Vulnerability Description
Opera Mail是挪威Opera公司研发的一款邮件客户端，它支持标签浏览、邮件会话和过滤器等。 Opera Mail客户端存在两个漏洞： 1. 没有用户缓存目录的警告便直接打开了附件文件，这就可能在"file://"环境中执行任意JavaScript。 2. 通常，文件名扩展是由Opera Mail的"Content-Type"判断的。但是，攻击者可以通过在文件名末尾附加额外的"."欺骗HTML文件，如"image.jpg."。 如果用户浏览了附件的话，攻击者就可以组合使用这两个漏洞执行脚本注入攻击。
CVSS Information
N/A
Vulnerability Type
N/A