{"schemaVersion":3,"id":"CVE-2008-1234","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to inject arbitrary web script or HTML via event handlers, aka \"Universal XSS using event handlers.\"","dates":{"published":"2008-03-27T10:00:00.000Z","modified":"2024-08-07T08:17:34.080Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.3,"severity":"medium","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.3,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02765,"percentile":0.86178,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.02765},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.02765,"percentile":0.86178}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.02765,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.02765,"percentile":0.86178}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"mozilla","product":"firefox","name":"Firefox","label":"firefox","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.0.0.12","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.0.0.12","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"firefox","label":"Firefox","category":"app"}},"hubHref":"/vendor/mozilla/firefox"},{"vendor":"mozilla","product":"seamonkey","name":"seamonkey","label":"seamonkey","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.1.8","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.1.8","eol":null,"hubHref":"/vendor/mozilla/seamonkey"},{"vendor":"mozilla","product":"thunderbird","name":"thunderbird","label":"thunderbird","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.0.0.12","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.0.0.12","eol":null,"hubHref":"/vendor/mozilla/thunderbird"}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securityfocus.com/archive/1/490196/100/0/threaded","label":"www.securityfocus.com/archive/1/490196/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://secunia.com/advisories/29541","label":"secunia.com/advisories/29541","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/29539","label":"secunia.com/advisories/29539","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.mozilla.org/security/announce/2008/mfsa2008-14.html","label":"www.mozilla.org/security/announce/2008/mfsa2008-14.html","hostname":"www.mozilla.org","tags":["X Refsource CONFIRM"]},{"url":"http://www.vupen.com/english/advisories/2008/0999/references","label":"www.vupen.com/english/advisories/2008/0999/references","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://secunia.com/advisories/30620","label":"secunia.com/advisories/30620","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/29560","label":"secunia.com/advisories/29560","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41455","label":"exchange.xforce.ibmcloud.com/vulnerabilities/41455","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://www.debian.org/security/2008/dsa-1532","label":"www.debian.org/security/2008/dsa-1532","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN"]},{"url":"http://secunia.com/advisories/30327","label":"secunia.com/advisories/30327","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1","label":"sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1","hostname":"sunsolve.sun.com","tags":["Vendor Advisory","X Refsource SUNALERT"]},{"url":"http://www.ubuntu.com/usn/usn-592-1","label":"www.ubuntu.com/usn/usn-592-1","hostname":"www.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU"]},{"url":"http://secunia.com/advisories/29616","label":"secunia.com/advisories/29616","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.securitytracker.com/id?1019694","label":"www.securitytracker.com/id?1019694","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"http://secunia.com/advisories/29550","label":"secunia.com/advisories/29550","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/29645","label":"secunia.com/advisories/29645","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.ubuntu.com/usn/usn-605-1","label":"www.ubuntu.com/usn/usn-605-1","hostname":"www.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU"]},{"url":"http://secunia.com/advisories/29607","label":"secunia.com/advisories/29607","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-239546-1","label":"sunsolve.sun.com/search/document.do?assetkey=1-26-239546-1","hostname":"sunsolve.sun.com","tags":["Vendor Advisory","X Refsource SUNALERT"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:155","label":"www.mandriva.com/security/advisories?name=MDVSA-2008:155","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA"]},{"url":"http://www.vupen.com/english/advisories/2008/1793/references","label":"www.vupen.com/english/advisories/2008/1793/references","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://www.debian.org/security/2008/dsa-1574","label":"www.debian.org/security/2008/dsa-1574","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN"]},{"url":"http://secunia.com/advisories/29558","label":"secunia.com/advisories/29558","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/29548","label":"secunia.com/advisories/29548","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/30370","label":"secunia.com/advisories/30370","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://rhn.redhat.com/errata/RHSA-2008-0208.html","label":"rhn.redhat.com/errata/RHSA-2008-0208.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://secunia.com/advisories/29526","label":"secunia.com/advisories/29526","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.vupen.com/english/advisories/2008/2091/references","label":"www.vupen.com/english/advisories/2008/2091/references","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html","label":"lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA08-087A.html","label":"www.us-cert.gov/cas/techalerts/TA08-087A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"http://secunia.com/advisories/29391","label":"secunia.com/advisories/29391","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/30192","label":"secunia.com/advisories/30192","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.kb.cert.org/vuls/id/466521","label":"www.kb.cert.org/vuls/id/466521","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN","US Government Resource"]},{"url":"http://www.slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.447313","label":"www.slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.447313","hostname":"www.slackware.com","tags":["Vendor Advisory","X Refsource SLACKWARE"]},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0209.html","label":"www.redhat.com/support/errata/RHSA-2008-0209.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://www.securityfocus.com/bid/28448","label":"www.securityfocus.com/bid/28448","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0207.html","label":"www.redhat.com/support/errata/RHSA-2008-0207.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9551","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9551","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]},{"url":"http://secunia.com/advisories/30016","label":"secunia.com/advisories/30016","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.debian.org/security/2008/dsa-1534","label":"www.debian.org/security/2008/dsa-1534","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00058.html","label":"www.redhat.com/archives/fedora-package-announce/2008-May/msg00058.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"http://secunia.com/advisories/29547","label":"secunia.com/advisories/29547","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/30105","label":"secunia.com/advisories/30105","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/30094","label":"secunia.com/advisories/30094","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200805-18.xml","label":"www.gentoo.org/security/en/glsa/glsa-200805-18.xml","hostname":"www.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO"]},{"url":"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0128","label":"wiki.rpath.com/wiki/Advisories:rPSA-2008-0128","hostname":"wiki.rpath.com","tags":["X Refsource CONFIRM"]},{"url":"http://secunia.com/advisories/31043","label":"secunia.com/advisories/31043","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00074.html","label":"www.redhat.com/archives/fedora-package-announce/2008-May/msg00074.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"http://www.vupen.com/english/advisories/2008/0998/references","label":"www.vupen.com/english/advisories/2008/0998/references","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://www.debian.org/security/2008/dsa-1535","label":"www.debian.org/security/2008/dsa-1535","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:080","label":"www.mandriva.com/security/advisories?name=MDVSA-2008:080","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA"]}],"lineage":{"upstream":[],"downstream":["DSA-1532-1","DSA-1534-1","DSA-1534-2","DSA-1535-1","DSA-1574-1","RHSA-2008:0207","RHSA-2008:0208","RHSA-2008:0209"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2008-03-27T10:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T08:17:34.080Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":18,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T17:34:40.741Z","stale":false,"partial":false}}