Pgbouncer

Pgbouncer

5 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.1

CVE-2025-2291

  • EPSS 0.03%
  • Published 16.04.2025 18:16:04
  • Last modified 17.04.2025 20:22:16

Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password

6.8

CVE-2021-3672

Exploit
  • EPSS 0.11%
  • Published 23.11.2021 19:15:07
  • Last modified 21.11.2024 06:22:07

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulner...

8.1

CVE-2021-3935

  • EPSS 0.37%
  • Published 22.11.2021 16:15:07
  • Last modified 21.11.2024 06:22:48

When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of TLS certificate verification and encryption. This flaw affects PgBounc...

8.1

CVE-2015-6817

  • EPSS 1.37%
  • Published 23.05.2017 04:29:01
  • Last modified 20.04.2025 01:37:25

PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.

7.5

CVE-2015-4054

Exploit
  • EPSS 3.38%
  • Published 23.05.2017 04:29:00
  • Last modified 20.04.2025 01:37:25

PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before a startup packet.