CVE-2022-2838

CVE-2022-2838 affects Eclipse Sphinx prior to 0.13.1. The vulnerability stems from using the Apache Xerces XML Parser without disabling processing of referenced external entities, enabling an attacker to inject arbitrary definitions and access local files, with data exfiltration possible via HTTP...

CVE-2022-2838

In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allowing the injection of arbitrary definitions which is able to access local files and expose their contents via HTTP requests...

Eclipse Sphinx 代码问题漏洞

Eclipse Sphinx is an extensible platform from the Eclipse Foundation that simplifies the creation of integrated modeling tool environments that support a single or multiple modeling languages which can be UML-based or native DSL, with a particular focus on industrial strength and interoperability...

confluence.sphinx-electronics.de Cross Site Scripting vulnerability OBB-2525566

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Mageia: Security Advisory (MGASA-2022-0110)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2022-0110 Updated sphinx packages fix security vulnerability

It was found that sphinx could allow arbitrary files to be read by abusing a configuration option. CVE-2020-29050...

Updated sphinx packages fix security vulnerability

It was found that sphinx could allow arbitrary files to be read by abusing a configuration option. CVE-2020-29050...

openSUSE 15 Security Update : sphinx (openSUSE-SU-2022:0054-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2022:0054-1 advisory. - SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal in conjunction with CVE-2019-14511 because the mysql client ca...

openSUSE: Security Advisory for sphinx (openSUSE-SU-2022:0054-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2022:0054-1 Security update for sphinx

This update for sphinx fixes the following issues: - CVE-2020-29050: SphinxSearch in Sphinx Technologies Sphinx allows directory traversal in conjunction with CVE-2019-14511 because the mysql client can be used for CALL SNIPPETS and loadfile operations on a full pathname e.g., a file in the /etc...

Security update for sphinx (moderate)

openSUSE Security Update: Security update for sphinx Announcement ID: openSUSE-SU-2022:0054-1 Rating: moderate References: 1157590 1195227 Cross-References: CVE-2020-29050 CVSS scores: CVE-2020-29050 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 An...

Security update for sphinx (moderate)

openSUSE Security Update: Security update for sphinx Announcement ID: openSUSE-SU-2022:0046-1 Rating: moderate References: 1195227 Cross-References: CVE-2020-29050 CVSS scores: CVE-2020-29050 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.4 An update th...

OPENSUSE-SU-2022:0046-1 Security update for sphinx

sphinx was updated to fix the following issues: - CVE-2020-29050: SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal in conjunction with CVE-2019-14511 because the mysql client can be used for CALL SNIPPETS and loadfile operations on a full pathname e.g., a file i...

Mageia: Security Advisory (MGASA-2020-0087)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the Sphinx search system, related to a path traversal error, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Sphinx search system is related to a path traversal error. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information using the CALL SNIPPETS operator or the loadfile function...

CVE-2020-29050

SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal in conjunction with CVE-2019-14511 because the mysql client can be used for CALL SNIPPETS and loadfile operations on a full pathname e.g., a file in the /etc directory. NOTE: this is unrelated to CMUSphinx...

Directory traversal

SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal in conjunction with CVE-2019-14511 because the mysql client can be used for CALL SNIPPETS and loadfile operations on a full pathname e.g., a file in the /etc directory. NOTE: this is unrelated to CMUSphinx...

CVE-2020-29050

SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal in conjunction with CVE-2019-14511 because the mysql client can be used for CALL SNIPPETS and loadfile operations on a full pathname e.g., a file in the /etc directory. NOTE: this is unrelated to CMUSphinx...

CVE-2020-29050

CVE-2020-29050 affects SphinxSearch in Sphinx Technologies Sphinx up to version 3.1.1, enabling directory traversal via the mysql client for CALL SNIPPETS and load_file with full pathnames (unrelated to CMUSphinx). The issue, often discussed with CVE-2019-14511, has been addressed in multiple Lin...

Sphinx Technologies Sphinx 路径遍历漏洞

Sphinx Technologies Sphinx is a full-text F/OSS search engine from Sphinx Technologies, USA. Sphinx Technologies Sphinx suffers from a path traversal vulnerability that stems from the discovery that sphinxsearch, a fast standalone full-text SQL search engine, can be allowed to abuse configuration...