EUVD-2006-5710

Malware in sbrugna...

EUVD-2013-6429

Malware in sbrugna...

CVE-2025-54291

Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses...

EUVD-2023-58908

Malicious code in bioql PyPI...

SUSE CVE-2025-54291

Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the export process in the images API endpoint. An attacker can determine the existence of projects by analyzing differences in HTTP status codes returned when querying with crafted fingerprints, such as using...

Canonical LXD Project Existence Determination Through Error Handling in Image Get Function

Impact The LXD /1.0/images endpoint is implemented as an AllowUntrusted API that requires no authentication, making it accessible to users without accounts. This API allows determining project existence through differences in HTTP status codes when accessed with the project parameter...

CVE-2025-54291

Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses...

Information Exposure

Overview github.com/canonical/lxd is an a modern, secure and powerful system container and virtual machine manager. Affected versions of this package are vulnerable to Information Exposure via differing HTTP status code responses in the images endpoint's AllowUntrusted API. An attacker can...

CVE-2025-54291

The CVE affects Canonical LXD, specifically the images API (LXD 1.0/images) where unauthenticated requests can reveal project existence by returning 404 for existing projects and 403 for non-existent ones. Root cause: error handling in the imagesGet path exposes project existence via HTTP status ...

CVE-2025-54291

Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses...

CVE-2025-54291

Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses...

CVE-2025-54291 Project existence disclosure in LXD images API

Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses...

MAL-2025-19812 Malicious code in es6-http-status-codes (npm)

The package es6-http-status-codes was found to contain malicious code...

Malicious code in es6-http-status-codes (npm)

The package es6-http-status-codes was found to contain malicious code...

Exploit for CVE-2025-46047

CVE-2025-46047 Silverpeas -u Example...

Vulnerability of the pam_sm_authenticate() function in the Yubico PAM module, pam-u2f, which allows a intruder to elevate their privileges

The vulnerability of the pamsmauthenticate function in the Yubico PAM module, specifically in pam-u2f, is related to the return of an incorrect status code. Exploiting this vulnerability could allow attackers to increase their privileges...

urllib3: Request body not stripped after redirect from 303 status changes request method to GET

A flaw was found in urllib3, an HTTP client library for Python. urllib3 doesn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303, after changing the method in a request from one that could accept a request body such as POST to GET, as is required by HTTP...

CVE-2024-57778

An issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the servers response from status code 500 to status code 200...

The vulnerability of the fs/cifs/smb2ops.c component in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the fs/cifs/smb2ops.c component in the Linux operating system is related to the return of incorrect status codes. Exploiting this vulnerability can allow an attacker to cause a service failure...