# CVEs published 2009-06-15

17 CVEs were published on June 15, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-2057](https://cve.now/CVE-2009-2057.md): Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNE (no CVSS)
- [CVE-2009-2058](https://cve.now/CVE-2009-2058.md): Apple Safari before 3.2.2 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response (no CVSS)
- [CVE-2009-2059](https://cve.now/CVE-2009-2059.md): Opera, possibly before 9.25, uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT respo (no CVSS)
- [CVE-2009-2060](https://cve.now/CVE-2009-2060.md): src/net/http/http\_transaction\_winhttp.cc in Google Chrome before 1.0.154.53 uses the HTTP Host header to determine the context of a document (no CVSS)
- [CVE-2009-2061](https://cve.now/CVE-2009-2061.md): Mozilla Firefox before 3.0.10 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attack (no CVSS)
- [CVE-2009-2062](https://cve.now/CVE-2009-2062.md): Apple Safari before 3.2.2 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers (no CVSS)
- [CVE-2009-2063](https://cve.now/CVE-2009-2063.md): Opera, possibly before 9.25, processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attacke (no CVSS)
- [CVE-2009-2064](https://cve.now/CVE-2009-2064.md): Microsoft Internet Explorer 8, and possibly other versions, detects http content in https web pages only when the top-level frame uses https (no CVSS)
- [CVE-2009-2065](https://cve.now/CVE-2009-2065.md): Mozilla Firefox 3.0.10, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which (no CVSS)
- [CVE-2009-2066](https://cve.now/CVE-2009-2066.md): Apple Safari detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to e (no CVSS)
- [CVE-2009-2067](https://cve.now/CVE-2009-2067.md): Opera detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute (no CVSS)
- [CVE-2009-2068](https://cve.now/CVE-2009-2068.md): Google Chrome detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to (no CVSS)
- [CVE-2009-2069](https://cve.now/CVE-2009-2069.md): Microsoft Internet Explorer before 8 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server (no CVSS)
- [CVE-2009-2070](https://cve.now/CVE-2009-2070.md): Opera displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middl (no CVSS)
- [CVE-2009-2071](https://cve.now/CVE-2009-2071.md): Google Chrome before 1.0.154.53 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, whi (no CVSS)
- [CVE-2009-2072](https://cve.now/CVE-2009-2072.md): Apple Safari does not require a cached certificate before displaying a lock icon for an https web site, which allows man-in-the-middle attac (no CVSS)
- [CVE-2009-2073](https://cve.now/CVE-2009-2073.md): Cross-site request forgery (CSRF) vulnerability in Linksys WRT160N wireless router hardware 1 and firmware 1.02.2 allows remote attackers to (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-06-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.