CVE-2008-0367

Mozilla Firefox 2.0.0.11, 3.0b2, and possibly earlier versions, when prompting for HTTP Basic Authentication, displays the site requesting the authentication after the Realm text, which might make it easier for remote HTTP servers to conduct phishing and spoofing attacks.

• CWE-200

• http://aviv.raffon.net/2008/01/02/YetAnotherDialogSpoofingFirefoxBasicAuthentication.aspxThird Party Advisory
• http://aviv.raffon.net/2008/01/05/FirefoxDialogSpoofingFAQ.aspxThird Party Advisory
• http://blog.mozilla.com/security/2008/01/04/basicauth-dialog-realm-value-spoofing/Vendor Advisory
• http://www.securityfocus.com/archive/1/485732/100/200/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/485738/100/200/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/27111Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=244273Issue Tracking, Vendor Advisory
• http://aviv.raffon.net/2008/01/02/YetAnotherDialogSpoofingFirefoxBasicAuthentication.aspxThird Party Advisory
• http://aviv.raffon.net/2008/01/05/FirefoxDialogSpoofingFAQ.aspxThird Party Advisory
• http://blog.mozilla.com/security/2008/01/04/basicauth-dialog-realm-value-spoofing/Vendor Advisory
• http://www.securityfocus.com/archive/1/485732/100/200/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/485738/100/200/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/27111Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=244273Issue Tracking, Vendor Advisory

Published

Jan 19, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-0361Directory traversal vulnerability in agregar_info.php in Gra…
• CVE-2008-0362Cross-site scripting (XSS) vulnerability in gallery.php in C…
• CVE-2008-0363Multiple SQL injection vulnerabilities in Clever Copy 3.0 an…
• CVE-2008-0364Buffer overflow in (1) BitTorrent 6.0 and earlier; and (2) u…
• CVE-2008-0365Multiple buffer overflows in CORE FORCE before 0.95.172 allo…
• CVE-2008-0366CORE FORCE before 0.95.172 does not properly validate argume…
• CVE-2008-0368onedcu in IBM Informix Dynamic Server (IDS) 10.x before 10.0…
• CVE-2008-0369Multiple unspecified programs in IBM Informix Dynamic Server…
• CVE-2008-0370Cross-site scripting (XSS) vulnerability in dohtaccess.html …
• CVE-2008-0371Multiple SQL injection vulnerabilities in aliTalk 1.9.1.1, w…
• CVE-2008-03728e6 R3000 Internet Filter 2.0.05.33, and other versions befo…
• CVE-2008-0373Unrestricted file upload vulnerability in PHP F1 Max's File …