Mixed passive/display content is content served over HTTP that is included in an HTTPS webpage, but that cannot alter other portions of the webpage. For example, an attacker could replace an image served over HTTP with an inappropriate image or message to the user. The attacker could also infer information about the user's activities by watching which images are served to the user; often images are only served on a specific page within a website. If the attacker observes HTTP requests to certain images, they could determine which webpage the user is visiting. Passive content list
This section lists all types of HTTP requests which are considered passive content:
<img> (src attribute) <audio> (src attribute) <video> (src attribute) <object> subresources (when an <object> performs HTTP requests)
It seems to me that the content loaded through HTTP within the HTTPS page is considered vulnerable. In this scenario the HTTP image (for example) is loaded without user interaction.
Should I consider dangerous also elements like
<a href=http://link>More info</a> which require a user to click on them?