Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2009-2047 State: PUBLISHED Published: 2009-07-16T15:00:00 Last Updated: 2024-08-07T05:36:20.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the Administration interface in Cisco Customer Response Solutions (CRS) before 7.0(1) SR2 in Cisco Unified Contact Center Express (aka CCX) server allows remote authenticated users to read, modify, or delete arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?1022569 - http://secunia.com/advisories/35861 - http://www.securityfocus.com/bid/35706 - http://www.vupen.com/english/advisories/2009/1913 - https:
m/advisories/35861 - http://www.securityfocus.com/bid/35706 - http://www.vupen.com/english/advisories/2009/1913 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51731 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080ae04b2.shtml - http://osvdb.org/55936
CVE ID: CVE-2009-2048 State: PUBLISHED Published: 2009-07-16T15:00:00 Last Updated: 2024-08-07T05:36:20.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Administration interface in Cisco Customer Response Solutions (CRS) before 7.0(1) SR2 in Cisco Unified Contact Center Express (aka CCX) server allows remote authenticated users to inject arbitrary web script or HTML into the CCX database via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?1022569 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51730 - http://secunia.com/advisories/35861 - http://osvdb.
22569 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51730 - http://secunia.com/advisories/35861 - http://osvdb.org/55937 - http://www.vupen.com/english/advisories/2009/1913 - http://www.securityfocus.com/bid/35705 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080ae04b2.shtml
CVE ID: CVE-2009-2049 State: PUBLISHED Published: 2009-07-30T18:00:00 Last Updated: 2024-08-07T05:36:20.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco IOS 12.0(32)S12 through 12.0(32)S13 and 12.0(33)S3 through 12.0(33)S4, 12.0(32)SY8 through 12.0(32)SY9, 12.2(33)SXI1 through 12.2(33)SXI2, 12.2XNC before 12.2(33)XNC2, 12.2XND before 12.2(33)XND1, and 12.4(24)T1; and IOS XE 2.3 through 2.3.1t and 2.4 through 2.4.0; when RFC4893 BGP routing is enabled, allows remote attackers to cause a denial of service (device reload) by using an RFC4271 peer to send a malformed update, aka Bug ID CSCta33973. Additional Analyst Notes: - CVE Program Container: References: - http://www.ci
malformed update, aka Bug ID CSCta33973. Additional Analyst Notes: - CVE Program Container: References: - http://www.cisco.com/en/US/products/products_security_advisory09186a0080aea4c9.shtml - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6853 - http://secunia.com/advisories/36046 - http://www.vupen.com/english/advisories/2009/2082 - http://www.securitytracker.com/id?1022619 - http://www.securityfocus.com/bid/35860
CVE ID: CVE-2009-2050 State: PUBLISHED Published: 2009-08-27T16:31:00 Last Updated: 2024-08-07T05:36:20.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco Unified Communications Manager (aka CUCM, formerly CallManager) before 6.1(1) allows remote attackers to cause a denial of service (voice-services outage) via a malformed header in a SIP message, aka Bug ID CSCsi46466. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/57452 - http://secunia.com/advisories/36499 - http://www.securityfocus.com/bid/36152 - http://secunia.com/advisories/36495 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080af2d11.shtml - http://www.se
/advisories/36495 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080af2d11.shtml - http://www.securitytracker.com/id?1022775
CVE ID: CVE-2009-2051 State: PUBLISHED Published: 2009-08-27T16:31:00 Last Updated: 2024-08-07T05:36:20.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco IOS 12.2 through 12.4 and 15.0 through 15.1, Cisco IOS XE 2.5.x and 2.6.x before 2.6.1, and Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x, 5.x before 5.1(3g), 6.x before 6.1(4), and 7.x before 7.1(2) allow remote attackers to cause a denial of service (device reload or voice-services outage) via a malformed SIP INVITE message that triggers an improper call to the sipSafeStrlen function, aka Bug IDs CSCsz40392 and CSCsz43987. Additional Analyst Notes: - CVE Program Container: References: - http
n function, aka Bug IDs CSCsz40392 and CSCsz43987. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/57453 - http://secunia.com/advisories/36499 - http://www.securityfocus.com/bid/36152 - http://secunia.com/advisories/36498 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080af2d11.shtml - http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a30f.shtml - http://www.securitytracker.com/id?1022775
CVE ID: CVE-2009-2052 State: PUBLISHED Published: 2009-08-27T16:31:00 Last Updated: 2024-08-07T05:36:20.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x, 5.x before 5.1(3g), 6.x before 6.1(4), 7.0 before 7.0(2), and 7.1 before 7.1(2); and Cisco Unified Presence 1.x, 6.x before 6.0(6), and 7.x before 7.0(4); allows remote attackers to cause a denial of service (TCP services outage) via a large number of TCP connections, related to "tracking of network connections," aka Bug IDs CSCsq22534 and CSCsw52371. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisorie
and CSCsw52371. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/2915 - http://secunia.com/advisories/36499 - http://secunia.com/advisories/37039 - http://securitytracker.com/id?1023018 - http://www.securityfocus.com/bid/36152 - http://secunia.com/advisories/36498 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080afc930.shtml - http://www.cisco.com/en/US/products/products_security_advisory09186a0080af2d11.shtml - http://www.securitytracker.com/id?1022775 - http://www.securityfocus.com/bid/36676
CVE ID: CVE-2009-2053 State: PUBLISHED Published: 2009-08-27T16:31:00 Last Updated: 2024-08-07T05:36:20.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x, 5.x before 5.1(3g), 6.x before 6.1(4), 7.0 before 7.0(2a)su1, and 7.1 before 7.1(2) allows remote attackers to cause a denial of service (file-descriptor exhaustion and SCCP outage) via a flood of TCP packets, aka Bug ID CSCsx32236. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/36499 - http://www.securityfocus.com/bid/36152 - http://secunia.com/advisories/36498 - http://osvdb.org/57455 - http://www.cisco.
ttp://www.securityfocus.com/bid/36152 - http://secunia.com/advisories/36498 - http://osvdb.org/57455 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080af2d11.shtml - http://www.securitytracker.com/id?1022775
CVE ID: CVE-2009-2054 State: PUBLISHED Published: 2009-08-27T16:31:00 Last Updated: 2024-08-07T05:36:20.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x, 5.x before 5.1(3g), 6.x before 6.1(4), 7.0 before 7.0(2a)su1, and 7.1 before 7.1(2a)su1 allows remote attackers to cause a denial of service (file-descriptor exhaustion and SIP outage) via a flood of TCP packets, aka Bug ID CSCsx23689. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/36499 - http://www.securityfocus.com/bid/36152 - http://secunia.com/advisories/36498 - http://www.cisco.com/en/US/products/pro
- http://www.securityfocus.com/bid/36152 - http://secunia.com/advisories/36498 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080af2d11.shtml - http://osvdb.org/57456 - http://www.securitytracker.com/id?1022775
CVE ID: CVE-2009-2055 State: PUBLISHED Published: 2009-08-19T17:00:00.000Z Last Updated: 2025-10-22T00:05:54.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://mailman.nanog.org/pipermail/nanog/2009-August/012719.html - http://securitytracker.com/id?1022739 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080af150f.shtml
CVE ID: CVE-2009-2056 State: PUBLISHED Published: 2009-08-21T17:00:00Z Last Updated: 2024-09-17T03:37:38.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco IOS XR 3.8.1 and earlier allows remote authenticated users to cause a denial of service (process crash) via vectors involving a BGP UPDATE message with many AS numbers prepended to the AS path. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1022756 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080af150f.shtml
CVE ID: CVE-2009-2057 State: PUBLISHED Published: 2009-06-15T19:00:00Z Last Updated: 2024-09-17T01:11:07.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack. Additional Analyst Notes: - CVE Program Container: References: - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - http://research.microsoft.com/apps/pubs/default.aspx?id=79323
CVE ID: CVE-2009-2058 State: PUBLISHED Published: 2009-06-15T19:00:00 Last Updated: 2024-08-07T05:36:20.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apple Safari before 3.2.2 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/51193 - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - http://research.microsoft.com/apps/
ilities/51193 - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - http://research.microsoft.com/apps/pubs/default.aspx?id=79323
CVE ID: CVE-2009-2059 State: PUBLISHED Published: 2009-06-15T19:00:00Z Last Updated: 2024-09-17T02:20:59.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: Opera, possibly before 9.25, uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack. Additional Analyst Notes: - CVE Program Container: References: - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - http://research.microsoft.com/apps/pubs/default.aspx?id=79323
CVE ID: CVE-2009-2060 State: PUBLISHED Published: 2009-06-15T19:00:00 Last Updated: 2024-08-07T05:36:20.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: src/net/http/http_transaction_winhttp.cc in Google Chrome before 1.0.154.53 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack. Additional Analyst Notes: - CVE Program Container: References: - http://src.chromium.org/viewvc/chrome?view=rev&revision=11669 - http://code.google.com/p/chromium/issues/detail?id=
s: - http://src.chromium.org/viewvc/chrome?view=rev&revision=11669 - http://code.google.com/p/chromium/issues/detail?id=7338 - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - https://bugzilla.mozilla.org/show_bug.cgi?id=479880 - http://sites.google.com/a/chromium.org/dev/getting-involved/dev-channel/release-notes/releasenotes1015453 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51194 - http://code.google.com/p/chromium/issues/detail?id=8473 - http://src.chromium.org/viewvc/chrome/branches/release_154.next/src/net/http/http_transaction_winhttp.cc?r1=11621&r2=11669&pathrev=11669 - http://research.microsoft.com/apps/pubs/default.aspx?id=79323
CVE ID: CVE-2009-2061 State: PUBLISHED Published: 2009-06-15T19:00:00 Last Updated: 2024-08-07T05:36:20.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mozilla Firefox before 3.0.10 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site. Additional Analyst Notes: - CVE Program Container: References: - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - http://www.securityfocus.com/bid/35412 - http://research.microsoft.com/apps/pubs/default.aspx?id=793
l-with-update.pdf - http://www.securityfocus.com/bid/35412 - http://research.microsoft.com/apps/pubs/default.aspx?id=79323 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51203
CVE ID: CVE-2009-2062 State: PUBLISHED Published: 2009-06-15T19:00:00 Last Updated: 2024-08-07T05:36:20.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apple Safari before 3.2.2 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/51202 - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - http://www.securityfocus.com/bid/35412 - ht
51202 - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - http://www.securityfocus.com/bid/35412 - http://research.microsoft.com/apps/pubs/default.aspx?id=79323
CVE ID: CVE-2009-2063 State: PUBLISHED Published: 2009-06-15T19:00:00 Last Updated: 2024-08-07T05:36:20.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: Opera, possibly before 9.25, processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site. Additional Analyst Notes: - CVE Program Container: References: - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - http://www.securityfocus.com/bid/35412 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51204 -
-with-update.pdf - http://www.securityfocus.com/bid/35412 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51204 - http://research.microsoft.com/apps/pubs/default.aspx?id=79323
CVE ID: CVE-2009-2064 State: PUBLISHED Published: 2009-06-15T19:00:00 Last Updated: 2024-08-07T05:36:20.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 8, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages." Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/51186 -
onal Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/51186 - http://www.securityfocus.com/bid/35403 - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - http://research.microsoft.com/apps/pubs/default.aspx?id=79323
CVE ID: CVE-2009-2065 State: PUBLISHED Published: 2009-06-15T19:00:00 Last Updated: 2024-08-07T05:36:20.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mozilla Firefox 3.0.10, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages." Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/51189 - http://
alyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/51189 - http://www.securityfocus.com/bid/35403 - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - http://research.microsoft.com/apps/pubs/default.aspx?id=79323
CVE ID: CVE-2009-2066 State: PUBLISHED Published: 2009-06-15T19:00:00 Last Updated: 2024-08-07T05:36:20.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apple Safari detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/35403 - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf
ferences: - http://www.securityfocus.com/bid/35403 - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - https://exchange.xforce.ibmcloud.com/vulnerabilities/51187 - http://research.microsoft.com/apps/pubs/default.aspx?id=79323
CVE ID: CVE-2009-2067 State: PUBLISHED Published: 2009-06-15T19:00:00 Last Updated: 2024-08-07T05:36:20.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: Opera detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/35403 - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - http:
s: - http://www.securityfocus.com/bid/35403 - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - http://research.microsoft.com/apps/pubs/default.aspx?id=79323
CVE ID: CVE-2009-2068 State: PUBLISHED Published: 2009-06-15T19:00:00 Last Updated: 2024-08-07T05:36:20.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google Chrome detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages." Additional Analyst Notes: - CVE Program Container: References: - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - https://exchange.xforce.ibmcloud.com/v
eferences: - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - https://exchange.xforce.ibmcloud.com/vulnerabilities/51192 - http://research.microsoft.com/apps/pubs/default.aspx?id=79323
CVE ID: CVE-2009-2069 State: PUBLISHED Published: 2009-06-15T19:00:00 Last Updated: 2024-08-07T05:36:20.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer before 8 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an arbitrary https site by letting a browser obtain a valid certificate from this site during one request, and then sending the browser a crafted 502 response page upon a subsequent request. Additional Analyst Notes: - CVE Program Container: References: - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - http://www.secu
VE Program Container: References: - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - http://www.securityfocus.com/bid/35411 - http://research.microsoft.com/apps/pubs/default.aspx?id=79323
CVE ID: CVE-2009-2070 State: PUBLISHED Published: 2009-06-15T19:00:00 Last Updated: 2024-08-07T05:36:20.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: Opera displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an arbitrary https site by letting a browser obtain a valid certificate from this site during one request, and then sending the browser a crafted 502 response page upon a subsequent request. Additional Analyst Notes: - CVE Program Container: References: - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - http://www.securityfocus.com/bid/35411 - http:
s: - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - http://www.securityfocus.com/bid/35411 - http://research.microsoft.com/apps/pubs/default.aspx?id=79323
CVE ID: CVE-2009-2071 State: PUBLISHED Published: 2009-06-15T19:00:00 Last Updated: 2024-08-07T05:36:20.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google Chrome before 1.0.154.53 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an arbitrary https site by letting a browser obtain a valid certificate from this site during one request, and then sending the browser a crafted 502 response page upon a subsequent request. Additional Analyst Notes: - CVE Program Container: References: - http://src.chromium.org/viewvc/chrome?view=rev&revision=11669 - http://code.google.com/p/
ogram Container: References: - http://src.chromium.org/viewvc/chrome?view=rev&revision=11669 - http://code.google.com/p/chromium/issues/detail?id=7338 - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - http://www.securityfocus.com/bid/35411 - https://bugzilla.mozilla.org/show_bug.cgi?id=479880 - http://sites.google.com/a/chromium.org/dev/getting-involved/dev-channel/release-notes/releasenotes1015453 - http://code.google.com/p/chromium/issues/detail?id=8473 - http://src.chromium.org/viewvc/chrome/branches/release_154.next/src/net/http/http_transaction_winhttp.cc?r1=11621&r2=11669&pathrev=11669 - http://research.microsoft.com/apps/pubs/default.aspx?id=79323
CVE ID: CVE-2009-2072 State: PUBLISHED Published: 2009-06-15T19:00:00 Last Updated: 2024-08-07T05:36:20.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apple Safari does not require a cached certificate before displaying a lock icon for an https web site, which allows man-in-the-middle attackers to spoof an arbitrary https site by sending the browser a crafted (1) 4xx or (2) 5xx CONNECT response page for an https request sent through a proxy server. Additional Analyst Notes: - CVE Program Container: References: - http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf - http://www.securityfocus.com/bid/35411 - http://research.microsoft.com/apps/pubs/default.aspx?id