Vulnerabilities

TI-2025-29069 CVE-2025-46328 · GHSA-wmjq-jrm2-9wfr

NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file

LOW 30

snowflake-connector-nodejs is a NodeJS driver for Snowflake.

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00172 Published 2025-04-28 Fixed in 2.0.4 CWE-367

TI-2025-29067 CVE-2025-46326 · GHSA-c82r-c9f7-f5mj

Snowflake Connector for .NET has race condition when checking access to Easy Logging configuration file

LOW 30

snowflake-connector-net is the Snowflake Connector for .NET.

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00165 Published 2025-04-28 Fixed in 4.4.1 CWE-367

TI-2025-18512 CVE-2025-24795 · GHSA-r2x6-cjg7-8r43

The Snowflake Connector for Python uses insecure cache files permissions

LOW 24

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00139 Published 2025-01-29 Fixed in 3.13.1 CWE-276

TI-2025-18511 CVE-2025-24794 · GHSA-m4f6-vcj4-w5mx

The Snowflake Connector for Python uses insecure deserialization of the OCSP response cache

LOW 34

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0025 Published 2025-01-29 Fixed in 3.13.1 CWE-502

TI-2025-18510 CVE-2025-24793 · GHSA-2vpq-fh52-j3wv

Snowflake Connector for Python has an SQL Injection in write_pandas

LOW 33

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations.

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00307 Published 2025-01-29 Fixed in 3.13.1 CWE-89

TI-2025-18505 CVE-2025-24788 · GHSA-2mqw-rq5m-8hc8

Snowflake Connector for .NET has weak temporary files permissions

LOW 24

snowflake-connector-net is the Snowflake Connector for .NET.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00143 Published 2025-01-29 Fixed in 4.3.0 CWE-276

TI-2025-18508 CVE-2025-24791 · GHSA-xfhv-wqj6-rx99

snowflake-connector-nodejs has incorrect validation of temporary credential cache file permissions

LOW 24

snowflake-connector-nodejs is a NodeJS driver for Snowflake.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00147 Published 2025-01-29 Fixed in 2.0.2 CWE-281

TI-2024-33218 CVE-2024-49750 · GHSA-5vvg-pvhp-hv2m

Snowflake Connector for Python has sensitive data in logs

LOW 24

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00202 Published 2024-10-24 Fixed in 3.12.3 CWE-532

TI-2023-28309 CVE-2023-51662 · GHSA-hwcc-4cv8-cf3h

Snowflake Connector .NET does not properly check the Certificate Revocation List (CRL)

LOW 33

The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00348 Published 2023-12-22 Fixed in 2.1.5 CWE-295

TI-2023-17066 CVE-2023-34230 · GHSA-223g-8w3x-98wr

Snowflake Connector vulnerable to Command Injection

MEDIUM 43

snowflake-connector-net, the Snowflake Connector for .NET, is vulnerable to command injection prior to version 2.0.18 via SSO URL authentication.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01431 Published 2023-06-08 Fixed in 2.0.18 CWE-77

TI-2023-17069 CVE-2023-34233 · GHSA-5w5m-pfw9-c8fp

Snowflake Python Connector vulnerable to Command Injection

MEDIUM 44

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01841 Published 2023-06-08 Fixed in 3.0.2 CWE-77

TI-2023-17068 CVE-2023-34232 · GHSA-h53w-7qw7-vh5c

Snowflake NodeJS Driver vulnerable to Command Injection

MEDIUM 44

snowflake-connector-nodejs, a NodeJS driver for Snowflake, is vulnerable to command injection via single sign on (SSO) browser URL authentication in versions prior to 1.6.21.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01897 Published 2023-06-08 Fixed in 1.6.21 CWE-77

TI-2022-20945 CVE-2022-42965 · GHSA-4r6j-fwcx-94cf

Exponential ReDoS in snowflake-connector-python leads to denial of service

HIGH 66

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the undocumented get_file_transfer_type m…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00956 Published 2022-11-09 Fixed in 2.8.2 CWE-1333

Vulnerabilities

Filters