CVE-2025-24790

CVE-2025-24790 affects Snowflake JDBC driver (type 4) used by Java apps. On Linux, when temporary credential caching is enabled, credentials may be cached locally in a world-readable file. Affected versions: 3.6.8 through 3.21.0. The issue has been fixed in version 3.22.0. Remediation: upgrade Sn...

CVE-2025-24789 Snowflake JDBC allows an untrusted search path on Windows

Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. When the EXTERNALBROWSER authentication method is used on Windows, an attacker with write...

CVE-2025-24789

CVE-2025-24789 — Snowflake JDBC Driver privilege escalation (Windows) Affected product: Snowflake JDBC Type 4 driver used by Java apps; Windows EXTERNALBROWSER authentication method on Windows with write access to a PATH directory can escalate privileges to the running user. Affected versions: 3....

CVE-2025-24789 Snowflake JDBC allows an untrusted search path on Windows

Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. When the EXTERNALBROWSER authentication method is used on Windows, an attacker with write...

CVE-2025-24789 Snowflake JDBC allows an untrusted search path on Windows

Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. When the EXTERNALBROWSER authentication method is used on Windows, an attacker with write...

Snowflake JDBC 代码问题漏洞

Snowflake JDBC is an application from Snowflake, Inc. provides a JDBC type 4 driver that supports the core functionality and allows Java programs to connect to Snowflak. A code issue vulnerability exists in Snowflake JDBC versions prior to 3.22.0 that stems from an attacker with write privileges...

PT-2025-5570 · Snowflake · Snowflake Jdbc Driver

Name of the Vulnerable Software and Affected Versions: Snowflake JDBC Driver versions 3.2.3 through 3.21.0 Description: The issue allows an attacker with write access to a directory in the %PATH% to escalate their privileges to the user that runs the vulnerable JDBC Driver version when the...

PT-2024-30544 · Snowflake · Snowflake Jdbc Driver

Name of the Vulnerable Software and Affected Versions: Snowflake JDBC driver versions = 3.2.6 and = 3.2.6 and = 3.19.1, upgrade to version 3.20.0 or later as soon as possible to fix the incorrect security setting. As a temporary workaround, consider avoiding the use of the CLIENT ENCRYPTION KEY...

Security Bulletin: IBM Security Guardium is affected by a snowflake-jdbc-3.13.8.jar vulnerability (CVE-2023-30535)

Summary IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID:CVE-2023-30535 DESCRIPTION: Snowflake Computing Snowflake JDBC could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a command injection flaw in the SSO URL...

Oracle GoldenGate for Big Data RCE (October 2023 CPU)

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is 21.3 = 21.10. It is, therefore, affected by a remote code execution vulnerability: - Vulnerability in the GoldenGate Big Data product of Oracle GoldenGate component:...

Oracle Business Intelligence Publisher (OBIEE) (July 2023 CPU)

The 5.9.0.0 and 6.4.0.0 versions of Oracle Business Intelligence Enterprise Edition installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2023 CPU advisory. - Vulnerability in the BI Publisher product of Oracle Analytics component: Security Apache CXF. Th...

Remote code execution

Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Users of the Snowflake JDBC driver were vulnerable to a command injection vulnerability. An attacker could set up a malicious, publicly accessible server which responds to...

CVE-2023-30535 Snowflake JDBC vulnerable to command injection via SSO URL authentication

Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Users of the Snowflake JDBC driver were vulnerable to a command injection vulnerability. An attacker could set up a malicious, publicly accessible server which responds to...

CVE-2023-30535 Snowflake JDBC vulnerable to command injection via SSO URL authentication

Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Users of the Snowflake JDBC driver were vulnerable to a command injection vulnerability. An attacker could set up a malicious, publicly accessible server which responds to...

com.damavis:damavis-spark-snowflake_2.12 (>=0.3.0 <=0.4.4), com.linkedin.feathr:feathr_2.12 (>=0.1.0 <=1.0.5-rc5) +49 more potentially affected by CVE-2023-30535 via net.snowflake:snowflake-jdbc (>=3.0.0 <=3.13.28)

net.snowflake:snowflake-jdbc MAVEN version =3.0.0, =0.3.0, =0.1.0, =1.2.0.0-rc2, =0.9.0, =0.9.0, =0.10.1, =1.0.0, =1.0.0, =3.0.0.Final, =3.0.0.Final, =3.1.3.Final and more Source cves: CVE-2023-30535 Source advisory: OSV:GHSA-4G3J-C4WG-6J7X...

Snowflake JDBC 命令注入漏洞

Snowflake JDBC is an application from Snowflake USA. provides a JDBC type 4 driver that supports core functionality and allows Java programs to connect to Snowflak. A command injection vulnerability exists in Snowflake JDBC versions prior to 3.13.29. An attacker could exploit this vulnerability t...