CVE-2018-18913

Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP archive composed of an HTML page along with a malicious DLL to the target. Once the document is opened, it may allow the attacker to take full control of the system from any location within the system. The issue lies in the loading of the shcore.dll and dcomp.dll files: these files are being searched for by the program in the same system-wide directory where the HTML file is executed.

• CWE-426

• https://blogs.opera.com/desktop/changelog-for-57/Vendor Advisory
• https://lucideustech.blogspot.com/2019/02/opera-search-order-hijacking-cve-2018-18913.htmlThird Party Advisory
• https://blogs.opera.com/desktop/changelog-for-57/Vendor Advisory
• https://lucideustech.blogspot.com/2019/02/opera-search-order-hijacking-cve-2018-18913.htmlThird Party Advisory

Published

Mar 21, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-18903Vanilla 2.6.x before 2.6.4 allows remote code execution.
• CVE-2018-18907An issue was discovered on D-Link DIR-850L 1.21WW devices. A…7.5
• CVE-2018-18908The Sky Go Desktop application 1.0.19-1 through 1.0.23-1 for…
• CVE-2018-18909xhEditor 1.2.2 allows XSS via JavaScript code in the SRC att…
• CVE-2018-1891IBM Security Guardium 10 and 10.5 is vulnerable to cross-sit…5.4
• CVE-2018-18912An issue was discovered in Easy File Sharing (EFS) Web Serve…
• CVE-2018-18915There is an infinite loop in the Exiv2::Image::printIFDStruc…
• CVE-2018-18919The WP Editor.md plugin 10.0.1 for WordPress allows XSS via …
• CVE-2018-1892IBM Rational Collaborative Lifecycle Management 6.0 through …5.4
• CVE-2018-18920Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute…
• CVE-2018-18921PHP Server Monitor before 3.3.2 has CSRF, as demonstrated by…
• CVE-2018-18922add_user in AbiSoft Ticketly 1.0 allows remote attackers to …