CVE-2009-2066

CVE-2009-2066 describes a vulnerability in Apple Safari where it fails to properly detect HTTP content within HTTPS web pages unless the top-level frame is also HTTPS. This flaw allows man-in-the-middle attackers to inject arbitrary web script into an HTTPS site's context by manipulating an HTTP page to include an HTTPS iframe referencing an HTTP script. With a CVSS score of 6.8, this vulnerability has a network attack vector and medium attack complexity, potentially leading to partial confidentiality, integrity, and availability impacts. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.