CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-43382
https://notcve.org/view.php?id=CVE-2024-43382
30 Oct 2024 — Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1 have an Incorrect Security Setting that can result in data being uploaded to an encrypted stage without the additional layer of protection provided by client side encryption. Las versiones del controlador JDBC de Snowflake >= 3.2.6 y <= 3.19.1 tienen una configuración de seguridad incorrecta que puede provocar que los datos se carguen en una etapa cifrada sin la capa adicional de protección proporcionada por el cifrado del lado del cliente. • https://github.com/snowflakedb/snowflake-jdbc/security/advisories/GHSA-f686-hw9c-xw9c • CWE-326: Inadequate Encryption Strength •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-30535 – Snowflake JDBC vulnerable to command injection via SSO URL authentication
https://notcve.org/view.php?id=CVE-2023-30535
14 Apr 2023 — Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Users of the Snowflake JDBC driver were vulnerable to a command injection vulnerability. An attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code ex... • https://community.snowflake.com/s/article/JDBC-Driver-Release-Notes • CWE-20: Improper Input Validation CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •