Opera Command Execution and Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities have been identified in Opera, which could be exploited by remote attackers to conduct cross-site scripting attacks or compromise a user's system.

1. Certain parameters passed to the "History Search" functionality are not properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which is executed in a user's browser session when the malicious data is being viewed.

Successful exploitation allows e.g. changing Opera's preferences, which can further be exploited to execute arbitrary commands.

2. An error exists in the handling of javascript URLs in the Links panel, which can be exploited to conduct cross-site scripting attacks with pages containing frames.