Pgbouncer

Pgbouncer

5 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.1

CVE-2025-2291

  • EPSS 0.03%
  • Veröffentlicht 16.04.2025 18:16:04
  • Zuletzt bearbeitet 17.04.2025 20:22:16

Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password

6.8

CVE-2021-3672

Exploit
  • EPSS 0.11%
  • Veröffentlicht 23.11.2021 19:15:07
  • Zuletzt bearbeitet 21.11.2024 06:22:07

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulner...

8.1

CVE-2021-3935

  • EPSS 0.37%
  • Veröffentlicht 22.11.2021 16:15:07
  • Zuletzt bearbeitet 21.11.2024 06:22:48

When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of TLS certificate verification and encryption. This flaw affects PgBounc...

8.1

CVE-2015-6817

  • EPSS 1.37%
  • Veröffentlicht 23.05.2017 04:29:01
  • Zuletzt bearbeitet 20.04.2025 01:37:25

PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.

7.5

CVE-2015-4054

Exploit
  • EPSS 3.38%
  • Veröffentlicht 23.05.2017 04:29:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before a startup packet.