debian/sphinxsearch vulnerabilities

Latest debian/sphinxsearch CVEs

Newest publication first

1. DLA-2882-1 sphinxsearch - security update

   Published 2022-01-17

   Unknown

2. CVE-2020-29050 SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal (in conjunction with CVE-2019-14511) because the mysql client can be used for CALL SNIPPETS and load_file operations...

   Published 2022-01-07

   High·CVSS 7.5 EPSS 2.2%

   SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal (in conjunction with CVE-2019-14511) because the mysql client can be used for CALL SNIPPETS and load_file operations on a full pathname (e.g., a file in the /etc directory). NOTE: this is unrelate...

3. DSA-5036-1 sphinxsearch - security update

   Published 2022-01-06

   Unknown

4. CVE-2019-14511 Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).

   Published 2019-08-22

   High·CVSS 7.5 EPSS 2.1%

   Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.