Peter Mularien

**Name of the Vulnerable Software and Affected Versions** Snowflake JDBC driver versions prior to 3.13.29 **Description** The Snowflake JDBC driver is affected by a command injection vulnerability via SSO URL authentication. An attacker can set up a malicious server that responds to the SSO URL with an attack payload. If the attacker tricks a user into visiting the maliciously crafted connection URL, the user's local machine will render the malicious payload, leading to remote code execution. **Recommendations** For all versions prior to 3.13.29, upgrade the Snowflake JDBC driver to the latest version: 3.13.29. As a temporary workaround, consider restricting access to the SSO URL authentication mechanism until the patch is applied. Avoid using maliciously crafted connection URLs to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle Communications Converged Application Server versions 7.1.0 through 8.0.0 **Description** The issue is related to insufficient input validation in the Core component of the Oracle Communications Converged Application Server, allowing an unauthenticated attacker with network access via UDP to compromise the server. Successful attacks can result in the takeover of the Oracle Communications Converged Application Server. **Recommendations** For versions 7.1.0 and 8.0.0, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.