CVE-2023-30535

Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Users of the Snowflake JDBC driver were vulnerable to a command injection vulnerability. An attacker could set up a malicious, publicly accessible server which responds to...

com.damavis:damavis-spark-snowflake_2.12 (>=0.3.0, <=0.4.4), com.dataforgedev:sparky (>=8.2.0-alpha.1, <=9.0.0-alpha.17) +114 more potentially affected by CVE-2023-30535 via net.snowflake:snowflake-jdbc (>=3.0.0, <=3.13.28)

net.snowflake:snowflake-jdbc MAVEN version =3.0.0, =0.3.0, =8.2.0-alpha.1, =0.1.0, =v1.2.0.1-1-gadc43b8, =1.2.0, =0.9.0, =0.9.0, =0.7.0, =1.0.0, =1.0.0, =1.0.1 - dev.ocpd.liquibase.ext:liquibase-hibernate5 4.18.0-b6 - dev.ocpd.liquibase:liquibase-cli 4.18.0-b6 and more Source cves: CVE-2023-30535...

CVE-2023-30535 Snowflake JDBC vulnerable to command injection via SSO URL authentication

Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Users of the Snowflake JDBC driver were vulnerable to a command injection vulnerability. An attacker could set up a malicious, publicly accessible server which responds to...

CVE-2023-30535 Snowflake JDBC vulnerable to command injection via SSO URL authentication

Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Users of the Snowflake JDBC driver were vulnerable to a command injection vulnerability. An attacker could set up a malicious, publicly accessible server which responds to...

GHSA-4G3J-C4WG-6J7X Snowflake JDBC vulnerable to command injection via SSO URL authentication

Snowflake JDBC driver is vulnerable to command injection vulnerability via SSO URL authentication. The vulnerability was patched on March 17, 2023 as part of Snowflake JDBC driver Version 3.13.29. An attacker could set up a malicious, publicly accessible server which responds to the SSO URL with ...

Snowflake JDBC vulnerable to command injection via SSO URL authentication

Snowflake JDBC driver is vulnerable to command injection vulnerability via SSO URL authentication. The vulnerability was patched on March 17, 2023 as part of Snowflake JDBC driver Version 3.13.29. An attacker could set up a malicious, publicly accessible server which responds to the SSO URL with ...

com.damavis:damavis-spark-snowflake_2.12 (>=0.3.0, <=0.4.4), com.dataforgedev:sparky (>=8.2.0-alpha.1, <=9.0.0-alpha.17) +114 more potentially affected by CVE-2023-30535 via net.snowflake:snowflake-jdbc (>=3.0.0, <=3.13.28)

net.snowflake:snowflake-jdbc MAVEN version =3.0.0, =0.3.0, =8.2.0-alpha.1, =0.1.0, =v1.2.0.1-1-gadc43b8, =1.2.0, =0.9.0, =0.9.0, =0.7.0, =1.0.0, =1.0.0, =1.0.1 - dev.ocpd.liquibase.ext:liquibase-hibernate5 4.18.0-b6 - dev.ocpd.liquibase:liquibase-cli 4.18.0-b6 and more Source cves: CVE-2023-30535...

com.damavis:damavis-spark-snowflake_2.12 (>=0.3.0, <=0.4.4), com.dataforgedev:sparky (>=8.2.0-alpha.1, <=9.0.0-alpha.17) +114 more potentially affected by CVE-2023-30535 via net.snowflake:snowflake-jdbc (>=3.0.0, <=3.13.28)

net.snowflake:snowflake-jdbc MAVEN version =3.0.0, =0.3.0, =8.2.0-alpha.1, =0.1.0, =v1.2.0.1-1-gadc43b8, =1.2.0, =0.9.0, =0.9.0, =0.7.0, =1.0.0, =1.0.0, =1.0.1 - dev.ocpd.liquibase.ext:liquibase-hibernate5 4.18.0-b6 - dev.ocpd.liquibase:liquibase-cli 4.18.0-b6 and more Source cves: CVE-2023-30535...

PT-2023-22762

Name of the Vulnerable Software and Affected Versions Snowflake JDBC driver versions prior to 3.13.29 Description The Snowflake JDBC driver is affected by a command injection vulnerability via SSO URL authentication. An attacker can set up a malicious server that responds to the SSO URL with an...

CVE-2023-30535: Improper Input Validation

Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Users of the Snowflake JDBC driver were vulnerable to a command injection vulnerability. An attacker could set up a malicious, publicly accessible server which responds to...

Snowflake JDBC 命令注入漏洞

Snowflake JDBC is an application from Snowflake USA. provides a JDBC type 4 driver that supports core functionality and allows Java programs to connect to Snowflak. A command injection vulnerability exists in Snowflake JDBC versions prior to 3.13.29. An attacker could exploit this vulnerability t...

GHSA-9C6G-QPGJ-RVXW Streamlit publishes previously-patched Cross-site Scripting vulnerability

Synopsis: Streamlit open source publicizes a prior security fix implemented in 2021. The vulnerability affected Streamlit versions between 0.63.0 and 0.80.0 inclusive and was patched on April 21, 2021. If you are using Streamlit with version before 0.63.0 or after 0.80.0, no action is required. 1...

Tor: Snowflake server: Leak of TLS packets from other clients

TLS packets from other clients were leaked to Snowflake clients due to a vulnerability in the Snowflake pluggable transport server. This issue allowed Snowflake clients to receive "ghost" packets at the KCP layer, containing TLS packets unrelated to the current session. The leaked packets include...

Let it snow! Wiz and Snowflake join forces to power insights with actionable intelligence

Automatically push Wiz-identified cloud security issues to Snowflake to analyze and accurately report on your cloud security metrics...

GHSA-4R6J-FWCX-94CF snowflake-connector-python is vulnerable to Regular Expression Denial of Service (ReDoS)

An exponential ReDoS Regular Expression Denial of Service can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the getfiletransfertype method...

snowflake-connector-python is vulnerable to Regular Expression Denial of Service (ReDoS)

An exponential ReDoS Regular Expression Denial of Service can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the getfiletransfertype method...

Regular Expression Denial Of Service (ReDoS)

snowflake-connector-python is vulnerable to regular expression denial of service. The vulnerability is due to the getfiletransfertype function in cursor.py which does not properly validate the SQL queries, allowing an attacker to crash the application by providing a malicious input...

CVE-2022-42965

An exponential ReDoS Regular Expression Denial of Service can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the undocumented getfiletransfertype method...

Design/Logic Flaw

An exponential ReDoS Regular Expression Denial of Service can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the undocumented getfiletransfertype method...

CVE-2022-42965 Exponential ReDoS in snowflake-connector-python leads to denial of service

An exponential ReDoS Regular Expression Denial of Service can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the undocumented getfiletransfertype method...