{"schemaVersion":3,"id":"CVE-2008-0416","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox  before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allow remote attackers to inject arbitrary web script or HTML via certain character encodings, including (1) a backspace character that is treated as whitespace, (2) 0x80 with Shift_JIS encoding, and (3) \"zero-length non-ASCII sequences\" in certain Asian character sets.","dates":{"published":"2008-02-12T02:00:00.000Z","modified":"2024-08-07T07:46:54.440Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.3,"severity":"medium","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.3,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0162,"percentile":0.75721,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.0162},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0162,"percentile":0.75721}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0162,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0162,"percentile":0.75721}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"mozilla","product":"firefox","name":"Firefox","label":"firefox","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.0.0.11","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.0.0.11","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"firefox","label":"Firefox","category":"app"}},"hubHref":"/vendor/mozilla/firefox"},{"vendor":"mozilla","product":"seamonkey","name":"seamonkey","label":"seamonkey","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.1.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.1.7","eol":null,"hubHref":"/vendor/mozilla/seamonkey"},{"vendor":"mozilla","product":"thunderbird","name":"Thunderbird","label":"thunderbird","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.0.0.11","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.0.0.11","eol":null,"hubHref":"/vendor/mozilla/thunderbird"}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.turbolinux.com/security/2008/TLSA-2008-9.txt","label":"www.turbolinux.com/security/2008/TLSA-2008-9.txt","hostname":"www.turbolinux.com","tags":["Vendor Advisory","X Refsource TURBO"]},{"url":"http://secunia.com/advisories/29541","label":"secunia.com/advisories/29541","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/40488","label":"exchange.xforce.ibmcloud.com/vulnerabilities/40488","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000021.html","label":"jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000021.html","hostname":"jvndb.jvn.jp","tags":["Third Party Advisory","X Refsource JVNDB"]},{"url":"http://secunia.com/advisories/30620","label":"secunia.com/advisories/30620","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://secunia.com/advisories/28865","label":"secunia.com/advisories/28865","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://secunia.com/advisories/28879","label":"secunia.com/advisories/28879","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://secunia.com/advisories/30327","label":"secunia.com/advisories/30327","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1","label":"sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1","hostname":"sunsolve.sun.com","tags":["Vendor Advisory","X Refsource SUNALERT"]},{"url":"http://www.ubuntu.com/usn/usn-592-1","label":"www.ubuntu.com/usn/usn-592-1","hostname":"www.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU"]},{"url":"http://www.debian.org/security/2008/dsa-1489","label":"www.debian.org/security/2008/dsa-1489","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-239546-1","label":"sunsolve.sun.com/search/document.do?assetkey=1-26-239546-1","hostname":"sunsolve.sun.com","tags":["Vendor Advisory","X Refsource SUNALERT"]},{"url":"http://secunia.com/advisories/28864","label":"secunia.com/advisories/28864","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://www.debian.org/security/2008/dsa-1485","label":"www.debian.org/security/2008/dsa-1485","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN"]},{"url":"http://www.vupen.com/english/advisories/2008/1793/references","label":"www.vupen.com/english/advisories/2008/1793/references","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Vendor Advisory"]},{"url":"https://bugzilla.mozilla.org/buglist.cgi?bug_id=404252%2C381412%2C407161","label":"bugzilla.mozilla.org/buglist.cgi?bug_id=404252%2C381412%2C407161","hostname":"bugzilla.mozilla.org","tags":["X Refsource MISC"]},{"url":"http://www.vupen.com/english/advisories/2008/2091/references","label":"www.vupen.com/english/advisories/2008/2091/references","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Vendor Advisory"]},{"url":"http://jvn.jp/en/jp/JVN21563357/index.html","label":"jvn.jp/en/jp/JVN21563357/index.html","hostname":"jvn.jp","tags":["Third Party Advisory","X Refsource JVN"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA08-087A.html","label":"www.us-cert.gov/cas/techalerts/TA08-087A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"http://www.mozilla.org/security/announce/2008/mfsa2008-13.html","label":"www.mozilla.org/security/announce/2008/mfsa2008-13.html","hostname":"www.mozilla.org","tags":["X Refsource CONFIRM"]},{"url":"http://www.debian.org/security/2008/dsa-1484","label":"www.debian.org/security/2008/dsa-1484","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN"]},{"url":"http://www.securityfocus.com/bid/29303","label":"www.securityfocus.com/bid/29303","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200805-18.xml","label":"www.gentoo.org/security/en/glsa/glsa-200805-18.xml","hostname":"www.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO"]},{"url":"http://secunia.com/advisories/31043","label":"secunia.com/advisories/31043","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://secunia.com/advisories/28839","label":"secunia.com/advisories/28839","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"https://usn.ubuntu.com/576-1/","label":"usn.ubuntu.com/576-1/","hostname":"usn.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU"]}],"lineage":{"upstream":[],"downstream":["DSA-1484-1","DSA-1485-2","DSA-1489-1","DSA-1506-1","RHSA-2008:0103","RHSA-2008:0104"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2008-02-12T02:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T07:46:54.440Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":18,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T08:27:18.957Z","stale":false,"partial":false}}