TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-fg2v-w576-w4v3
Summary: Out of bounds read in json-smart
Aliases: CVE-2021-31684
Severity: HIGH
CWE: CWE-125, CWE-787
Published: 2022-02-10T22:46:22Z

A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions prior to 1.3.3 and 2.4.5 which causes a denial of service (DOS) via a crafted web request.
Vulnerability: GHSA-w29m-fjp4-qhmq
Summary: Unsafe Identifiers in Opencast
Aliases: CVE-2020-5230
Severity: MODERATE
CWE: CWE-99
Published: 2020-01-30T21:21:50Z

### Impact

Opencast allows almost arbitrary identifiers for media packages and
elements to be used. This can be problematic for operation and security
since such identifiers are sometimes used for file system operations
which may lead to an attacker being able to escape working directories and
write files to other locations.

In addition, Opencast's Id.toString(…) vs Id.compact(…) behavior,
the latter trying to mitigate some of the file system problems, can
cause errors due to identifier mismatch since an identifier may
unintentionally change.

### Patches

This issue is fixed in Opencast 7.6 and 8.1.

### Workarounds

There is no workaround for this.

### For more information

If you have any questions or comments about this advisory:

- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues)
- For security-relevant information, email us at security@opencast.org
Vulnerability: GHSA-jpj4-5xwp-cv23
Summary: Remote code execution in DolphinScheduler
Aliases: CVE-2020-11974
Severity: CRITICAL
CWE: CWE-502
Published: 2022-02-09T22:44:54Z

In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database.
Vulnerability: GHSA-3w5h-x4rh-hc28
Summary: Exposure of sensitive information in Apache Ozone
Aliases: CVE-2021-39231
Severity: CRITICAL
CWE: CWE-668
Published: 2021-11-23T18:18:25Z

In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration.
Vulnerability: GHSA-v9mf-jgq3-c28h
Summary: Data Amplification in Play Framework
Aliases: CVE-2020-28923
Severity: LOW
CWE: CWE-20
Published: 2022-02-09T22:54:21Z

An issue was discovered in Play Framework 2.8.0 through 2.8.4. Carefully crafted JSON payloads sent as a form field lead to Data Amplification. This affects users migrating from a Play version prior to 2.8.0 that used the Play Java API to serialize classes with protected or private fields to JSON.
Vulnerability: GHSA-h353-hc43-95vc
Summary: Script injection without script or programming rights through Gadget titles
Aliases: CVE-2021-32621
Severity: HIGH
CWE: CWE-94
Published: 2021-05-18T18:36:16Z

### Impact
A user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard.

### Patches
The issue has been patched in XWiki 12.6.7, 12.10.3 and 13.0RC1.

### Workarounds
There's no easy workaround for this issue, it is recommended to upgrade XWiki.

### References
https://jira.xwiki.org/browse/XWIKI-17794

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JIRA](https://jira.xwiki.org)
* Email us at [XWiki security mailing-list](mailto:security@xwiki.org)
Vulnerability: GHSA-mhx2-r3jx-g94c
Summary: Moderate severity vulnerability that affects org.apache.camel:camel-core
Aliases: CVE-2015-0264
Severity: MODERATE
Published: 2018-10-16T23:09:15Z

Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.
Vulnerability: GHSA-w285-wf9q-5w69
Summary: In Bouncy Castle JCE Provider the ECIES implementation allowed the use of ECB mode
Aliases: CVE-2016-1000352
Severity: HIGH
CWE: CWE-326
Published: 2018-10-17T16:27:38Z

In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
Vulnerability: GHSA-6pmv-7pr9-cgrj
Summary: Predictable password in Keycloak
Aliases: CVE-2020-1731
Severity: CRITICAL
CWE: CWE-330, CWE-341
Published: 2020-04-15T21:09:27Z

A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random admin password when installing Keycloak, however the password remains the same when deployed to the same OpenShift namespace.
Vulnerability: GHSA-m5wp-p3gj-7q5g
Summary: Missing Authorization in Jenkins dbCharts Plugin
Aliases: CVE-2022-25206
Severity: HIGH
CWE: CWE-862
Published: 2022-02-16T00:01:16Z

A missing check in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified database via JDBC using attacker-specified credentials.
Vulnerability: GHSA-mx3x-rmrh-9wf6
Summary: SQL injection in net.mingsoft:ms-mcms
Aliases: CVE-2022-26585
Severity: HIGH
Published: 2022-04-06T00:01:35Z

Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.
Vulnerability: GHSA-mmf6-6597-3v6m
Summary: Open Redirect in Spring Security OAuth
Aliases: CVE-2019-11269
Severity: MODERATE
CWE: CWE-601
Published: 2019-06-13T20:18:28Z

Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.
Vulnerability: GHSA-7c2r-3jqf-c9rw
Summary: Moderate severity vulnerability that affects com.fasterxml.jackson.dataformat:jackson-dataformat-xml
Aliases: CVE-2016-7051
Severity: HIGH
CWE: CWE-918, CWE-611
Published: 2018-10-18T17:43:28Z

XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.
Vulnerability: GHSA-xvch-r4wf-h8w9
Summary: Moderate severity vulnerability that affects org.apache.qpid:proton-j
Aliases: CVE-2018-17187
Severity: HIGH
CWE: CWE-295
Published: 2018-11-21T22:22:21Z

The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with options to configure this explicitly or select a certificate verification mode with or without hostname verification being performed. The latter hostname verifying mode was not implemented in Apache Qpid Proton-J versions 0.3 to 0.29.0, with attempts to use it resulting in an exception. This left only the option to verify the certificate is trusted, leaving such a client vulnerable to Man In The Middle (MITM) attack. Uses of the Proton-J protocol engine which do not utilise the optional transport TLS wrapper are not impacted, e.g. usage within Qpid JMS. Uses of Proton-J utilising the optional transport TLS wrapper layer that wish to enable hostname verification must be upgraded to version 0.30.0 or later and utilise the VerifyMode#VERIFY_PEER_NAME configuration, which is now the default for client mode usage unless configured otherwise.
Vulnerability: GHSA-4x49-w62v-76q7
Summary: Path Traversal in Spring Cloud Config
Aliases: CVE-2019-3799
Severity: MODERATE
CWE: CWE-22
Published: 2019-05-23T08:39:23Z

Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
Vulnerability: GHSA-3x9f-74h4-2fqr
Summary: Denial of Service in SheetJS Pro
Aliases: CVE-2021-32012
Severity: MODERATE
CWE: CWE-400
Published: 2021-07-22T19:48:17Z

SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 1 of 2).
Vulnerability: GHSA-rv39-3qh7-9v7w
Summary: Improper Input Validation in Spring Framework
Aliases: CVE-2020-5421
Severity: MODERATE
CWE: CWE-35
Published: 2021-04-30T17:29:51Z

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
Vulnerability: GHSA-5q99-f34m-67gc
Summary: Moderate severity vulnerability that affects org.apache.tomcat.embed:tomcat-embed-core
Aliases: CVE-2018-11784
Severity: MODERATE
CWE: CWE-601
Published: 2018-10-17T16:31:02Z

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
Vulnerability: GHSA-2rmm-87v7-34rj
Summary: Improper Restriction of XML External Entity Reference in Any23
Aliases: CVE-2022-25312
Severity: CRITICAL
CWE: CWE-611
Published: 2022-03-06T00:00:17Z

An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions < 2.7. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Any23 2.7.
Vulnerability: GHSA-jj4f-p7vv-j4v9
Summary: Arbitrary code execution in Apache Druid
Aliases: CVE-2021-26919
Severity: HIGH
CWE: CWE-668
Published: 2021-06-16T17:51:58Z

Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Druid server processes. This issue was addressed in Apache Druid 0.20.2
Vulnerability: GHSA-q4hm-fwc9-hmv6
Summary: Insecure temporary file used in com.squareup:connect
Aliases: CVE-2021-23331
Severity: LOW
CWE: CWE-377
Published: 2021-06-16T17:53:20Z

This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded by downloadFileFromResponse will be visible to all other users on the local system. A workaround fix for this issue is to set the system property java.io.tmpdir to a safe directory as remediation. Note: This version of the SDK is end of life and no longer maintained, please upgrade to the latest version.
Vulnerability: GHSA-f6jp-j6w3-w9hm
Summary: Improper Authentication in Apache Shiro
Aliases: CVE-2021-41303
Severity: MODERATE
CWE: CWE-287
Published: 2021-09-20T20:18:11Z

Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.
Vulnerability: GHSA-vfqx-33qm-g869
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36189
Severity: HIGH
CWE: CWE-502
Published: 2021-12-09T19:16:59Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.
Vulnerability: GHSA-64gv-3pqv-299h
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Apache Wicket
Aliases: CVE-2020-11976
Severity: HIGH
CWE: CWE-200
Published: 2021-05-07T15:54:15Z

By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
Vulnerability: GHSA-2vgm-wxr3-6w2j
Summary: Authentication bypass in Apache Shiro
Aliases: CVE-2020-13933
Severity: HIGH
CWE: CWE-287
Published: 2021-05-07T15:54:23Z

Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.
Vulnerability: GHSA-q77q-vx4q-xx6q
Summary: Cross-site Scripting in org.owasp.esapi:esapi
Aliases: CVE-2022-24891
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-27T21:09:46Z

### Impact
There is a potential for an XSS vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can cause URLs with the "javascript:" scheme to NOT be sanitized. See the reference below for full details.

### Patches
Patched in ESAPI 2.3.0.0 and later. See important remediation details in the reference given below.

### Workarounds
Manually edit your **antisamy-esapi.xml** configuration files to change the "onsiteURL" regular expression as per remediation instructions in the reference below.

### References
[Security Bulletin 8](https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin8.pdf)

### For more information
If you have any questions or comments about this advisory:
* Email one of the project co-leaders. See email addresses listed on  the [OWASP ESAPI wiki](https://owasp.org/www-project-enterprise-security-api/) page, under "Leaders".
* Send email to one of the two ESAPI related Google Groups listed under [Where to Find More Information on ESAPI](https://github.com/ESAPI/esapi-java-legacy#where-to-find-more-information-on-esapi) on our [README.md](https://github.com/ESAPI/esapi-java-legacy#readme) page.
Vulnerability: GHSA-3qp6-m7hp-jrwf
Summary: Cross-site Scripting in Apache Pluto
Aliases: CVE-2021-36739
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-08T00:46:21Z

The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks.
Vulnerability: GHSA-gfhx-jjwq-63gv
Summary: Cross-site Scripting in Apereo CAS
Aliases: CVE-2021-42567
Severity: MODERATE
CWE: CWE-79
Published: 2021-12-10T20:24:11Z

Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.
Vulnerability: GHSA-2pqj-h3vj-pqgw
Summary: Cross-Site Scripting in jquery
Aliases: CVE-2012-6708
Severity: HIGH
CWE: CWE-64, CWE-79
Published: 2020-09-01T16:41:46Z

Affected versions of `jquery` are vulnerable to cross-site scripting. This occurs because the main `jquery` function uses a regular expression to differentiate between HTML and selectors, but does not properly anchor the regular expression. The result is that `jquery` may interpret HTML as selectors when given certain inputs, allowing for client side code execution.

## Proof of Concept
```
$("#log").html(
    $("element[attribute='<img src=\"x\" onerror=\"alert(1)\" />']").html()
);
```




## Recommendation

Update to version 1.9.0 or later.
Vulnerability: GHSA-cggj-fvv3-cqwv
Summary: FasterXML jackson-databind allows unauthenticated remote code execution 
Aliases: CVE-2018-7489
Severity: CRITICAL
CWE: CWE-502, CWE-184
Published: 2018-10-16T17:45:18Z

FasterXML jackson-databind before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.
Vulnerability: GHSA-cj6j-32rg-45r2
Summary: Cross-site Scripting in JSPWiki
Aliases: CVE-2019-10077
Severity: MODERATE
CWE: CWE-79
Published: 2019-06-06T15:29:25Z

A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
Vulnerability: GHSA-q62h-jw38-24vh
Summary: Uncaught Exception in zip4j
Aliases: CVE-2022-24615
Severity: MODERATE
CWE: CWE-755, CWE-248
Published: 2022-02-25T00:01:04Z

zip4j up to 2.9.1 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. This could be used to mount a denial of service attack against services that use zip4j library.
Vulnerability: GHSA-jwhm-9cjm-4493
Summary: Cross-site Scripting in Jenkins Dashboard View Plugin
Aliases: CVE-2021-21649
Severity: MODERATE
CWE: CWE-79
Published: 2021-06-16T17:24:41Z

Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.
Vulnerability: GHSA-43gc-mjxg-gvrq
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-21350
Severity: MODERATE
CWE: CWE-502, CWE-434
Published: 2021-03-22T23:29:28Z

### Impact
The vulnerability may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21350](https://x-stream.github.io/CVE-2021-21350.html).

### Credits
The vulnerability was discovered and reported by threedr3am.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-75p6-52g3-rqc8
Summary: Privilege escalation vulnerability on Token Exchange feature
Aliases: CVE-2022-1245
Severity: MODERATE
CWE: CWE-284
Published: 2022-04-26T21:21:00Z

A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a client to gain unauthorized access to additional services.
Vulnerability: GHSA-mg53-xr8m-86hw
Summary: Open Redirect in Liferay Portal
Aliases: CVE-2020-24554
Severity: HIGH
CWE: CWE-601
Published: 2021-05-07T15:54:54Z

The redirect module in Liferay Portal before 7.3.3 does not limit the number of URLs resulting in a 404 error that is recorded, which allows remote attackers to perform a denial of service attack by making repeated requests for pages that do not exist.
Vulnerability: GHSA-378p-hrq3-x4p3
Summary: Cross-site scripting in Shopizer
Aliases: CVE-2021-33562
Severity: MODERATE
CWE: CWE-79
Published: 2021-06-08T23:08:20Z

A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via the ref parameter to a page about an arbitrary product, e.g., a product/insert-product-name-here.html/ref= URL.
Vulnerability: GHSA-g37q-26qx-8v2m
Summary: Denial of service in Apache OpenMeetings
Aliases: CVE-2020-13951
Severity: HIGH
CWE: CWE-400
Published: 2022-02-10T20:36:45Z

Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.
Vulnerability: GHSA-35fg-hjcr-j65f
Summary: Information exposure in xwiki-platform
Aliases: CVE-2022-23619
Severity: MODERATE
CWE: CWE-200, CWE-640
Published: 2022-02-09T21:51:19Z

### Impact
It's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users.

### Patches
The problem has been patched on XWiki 12.10.9, 13.4.1 and 13.6RC1.

### Workarounds
There's no easy workaround other than applying the upgrade.

### References

https://jira.xwiki.org/browse/XWIKI-18787

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JIRA](https://jira.xwiki.org)
* Email us at [XWiki Security Mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-wjxj-f8rg-99wx
Summary: Moderate severity vulnerability that affects org.apache.thrift:libthrift
Aliases: CVE-2018-1320
Severity: HIGH
CWE: CWE-20, CWE-295
Published: 2019-01-17T13:56:40Z

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
Vulnerability: GHSA-cqqj-4p63-rrmm
Summary: HTTP Request Smuggling in Netty
Aliases: CVE-2019-20444
Severity: CRITICAL
CWE: CWE-444
Published: 2020-02-21T18:55:24Z

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."
Vulnerability: GHSA-mcfm-h73v-635m
Summary: High severity vulnerability that affects io.undertow:undertow-core
Aliases: CVE-2017-2666
Severity: MODERATE
CWE: CWE-444
Published: 2018-10-19T16:55:14Z

It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.
Vulnerability: GHSA-r695-7vr9-jgc2
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36187
Severity: HIGH
CWE: CWE-502
Published: 2021-12-09T19:16:51Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.
Vulnerability: GHSA-cghx-9gcr-r42x
Summary: Path Traversal in the Java Kubernetes Client
Aliases: CVE-2020-8570
Severity: MODERATE
CWE: CWE-22
Published: 2021-01-29T18:12:54Z

Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executing the client code.
Vulnerability: GHSA-5ww9-j83m-q7qx
Summary: Information exposure in FasterXML jackson-databind
Aliases: CVE-2019-12086
Severity: HIGH
CWE: CWE-502
Published: 2019-05-23T09:32:24Z

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.
Vulnerability: GHSA-7rpj-hg47-cx62
Summary: Improper Restriction of XML External Entity Reference in com.h2database:h2.
Aliases: CVE-2021-23463
Severity: HIGH
CWE: CWE-611
Published: 2021-12-16T14:29:57Z

H2 is an embeddable RDBMS written in Java. The package com.h2database:h2 from 0 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.
Vulnerability: GHSA-mph4-vhrx-mv67
Summary: Deserialization of Untrusted Data in FasterXML jackson-databind
Aliases: CVE-2019-12384
Severity: MODERATE
CWE: CWE-502
Published: 2019-07-05T21:07:27Z

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.
Vulnerability: GHSA-44qp-qhfv-c7f6
Summary: Improper Handling of Exceptional Conditions in Apache Tomcat
Aliases: CVE-2021-30639
Severity: HIGH
CWE: CWE-755
Published: 2021-08-13T15:21:02Z

A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.
Vulnerability: GHSA-vw83-h3mq-3qwj
Summary: Path Traversal in Spring-integration-zip
Aliases: CVE-2021-22114
Severity: MODERATE
CWE: CWE-22
Published: 2022-03-18T17:40:44Z

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder.
Vulnerability: GHSA-8rf5-92jh-3vc9
Summary: Uncaught Exception leading to Denial of Service in json-sanitizer
Aliases: CVE-2021-23900
Severity: HIGH
CWE: CWE-248
Published: 2021-05-13T22:31:32Z

OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input. This may lead to denial of service if the application is not prepared to handle these situations.
Vulnerability: GHSA-6x3v-rw2q-9gx7
Summary: Improper implementation of the session fixation protection in Infinispan
Aliases: CVE-2019-10158
Severity: CRITICAL
CWE: CWE-384
Published: 2020-01-21T21:18:44Z

A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.
Vulnerability: GHSA-3264-3fm9-fg44
Summary: Infinite Loop in Apache Tika
Aliases: CVE-2020-1951
Severity: MODERATE
CWE: CWE-835
Published: 2021-05-07T15:54:00Z

A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.
Vulnerability: GHSA-w6g3-v46q-5p28
Summary: Moderate severity vulnerability that affects org.apache.tika:tika-core
Aliases: CVE-2018-11762
Severity: MODERATE
CWE: CWE-22
Published: 2018-10-17T15:49:58Z

In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file.
Vulnerability: GHSA-45r8-3495-x6rm
Summary: High severity vulnerability that affects com.hubspot.jinjava:jinjava
Aliases: CVE-2018-18893
Severity: MODERATE
Published: 2019-01-04T17:43:36Z

Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java.
Vulnerability: GHSA-95m6-mjh3-58gm
Summary: Moderate severity vulnerability that affects org.keycloak:keycloak-core
Aliases: CVE-2016-8609
Severity: HIGH
CWE: CWE-287, CWE-384
Published: 2018-10-18T16:48:41Z

It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit further possible attacks.
Vulnerability: GHSA-6vwp-35w3-xph8
Summary: Insecure Deserialization in Apache XML-RPC
Aliases: CVE-2019-17570
Severity: CRITICAL
CWE: CWE-502
Published: 2020-06-10T20:02:39Z

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code.

Apache XML-RPC is no longer maintained and this issue will not be fixed.
Vulnerability: GHSA-87p2-cvhq-q4mv
Summary: Authentication bypass in Apache Zeppelin
Aliases: CVE-2020-13929
Severity: HIGH
CWE: CWE-287
Published: 2021-09-07T22:56:56Z

Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication mechanism to act as another user. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.
Vulnerability: GHSA-27xj-rqx5-2255
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-11619
Severity: HIGH
CWE: CWE-502
Published: 2020-05-15T18:58:44Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
Vulnerability: GHSA-9699-gm7f-cmjv
Summary: Unsynchronized Access to Shared Data in a Multithreaded Context in RESTEasy
Aliases: CVE-2020-25724
Severity: MODERATE
CWE: CWE-567
Published: 2021-06-08T22:29:46Z

A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided. This flaw allows an attacker to gain access to privileged information. The highest threat from this vulnerability is to confidentiality and integrity. Versions before resteasy 2.0.0.Alpha3 are affected.
Vulnerability: GHSA-jc7r-v6fg-2gpf
Summary: High severity vulnerability that affects org.apache.cxf:apache-cxf, org.apache.cxf:apache-cxf , and org.apache.cxf:cxf
Aliases: CVE-2018-8039
Severity: HIGH
CWE: CWE-755
Published: 2018-10-19T16:40:01Z

It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier work with the old com.sun.net.ssl.HostnameVerifier interface. However, the default HostnameVerifier implementation in CXF does not implement the method in this interface, and an exception is thrown. However, in Apache CXF prior to 3.2.5 and 3.1.16 the exception is caught in the reflection code and not properly propagated. What this means is that if you are using the com.sun.net.ssl stack with CXF, an error with TLS hostname verification will not be thrown, leaving a CXF client subject to man-in-the-middle attacks.
Vulnerability: GHSA-c9x9-xv66-xp3v
Summary: Improper privilege management in Keycloak
Aliases: CVE-2020-14389
Severity: HIGH
CWE: CWE-269, CWE-916
Published: 2021-11-10T15:30:36Z

A flaw was found in Keycloak, where it would permit a user with a view-profile role to manage the resources in the new account console. This flaw allows a user with a view-profile role to access and modify data for which the user does not have adequate permission.
Vulnerability: GHSA-m6gg-86c6-gfr9
Summary: Cross-site Scripting in elasticsearch
Aliases: CVE-2022-23710
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-04T00:00:15Z

A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary JavaScript to be executed in a victim’s browser.
Vulnerability: GHSA-25xc-jwfq-39jw
Summary: Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19
Aliases: CVE-2021-31407
Severity: HIGH
CWE: CWE-402, CWE-668
Published: 2021-04-19T14:50:49Z

Vulnerability in OSGi integration in `com.vaadin:flow-server` versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.

- https://vaadin.com/security/cve-2021-31407
Vulnerability: GHSA-v662-xpcc-9xf6
Summary: It's possible to execute anything with the rights of the author of a macro which uses the {{wikimacrocontent}} macro
Aliases: CVE-2021-21379
Severity: LOW
CWE: CWE-281
Published: 2021-03-23T22:47:26Z

### Impact

The `{{wikimacrocontent}}` executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inject scripts through it and they will be executed with the rights of the wiki macro (very often a user which has Programming rights).

Fortunately, no such macro exists by default in XWiki Standard but one could have been created or installed with an extension.

### Patches

It has been patched in versions XWiki 12.6.3, 11.10.11 and 12.8-rc-1.

### Workarounds

There is no easy workaround other than disabling the affected macros.
Inserting content in a safe way or knowing what is the user who called the wiki macro is not easy.

### References

https://jira.xwiki.org/browse/XWIKI-17759

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [our security mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-p43x-xfjf-5jhr
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-9548
Severity: CRITICAL
CWE: CWE-502
Published: 2020-05-15T18:59:01Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
Vulnerability: GHSA-vh5c-jqfg-mhrh
Summary: Cross-Site Request Forgery in xwiki-platform
Aliases: CVE-2021-32732
Severity: HIGH
CWE: CWE-352
Published: 2022-02-10T22:42:46Z

### Impact
It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually tight to that email by forging a request to the Forgot username page. Note that since this page does not have a CSRF check it's quite easy to perform a lot of those requests.

### Patches
This issue has been patched in XWiki 12.10.5 and 13.2RC1. Two different patches are provided:
  - a first one to fix the CSRF problem
  - a more complex one that now relies on sending an email for the Forgot username process.

### Workarounds
It's possible to fix the problem without uprading by editing the ForgotUsername page in version below 13.x, to use the following code: https://github.com/xwiki/xwiki-platform/blob/69548c0320cbd772540cf4668743e69f879812cf/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/ForgotUsername.xml#L39-L123

In version after 13.x it's also possible to edit manually the forgotusername.vm file, but it's really encouraged to upgrade the version here.

### References
  * https://jira.xwiki.org/browse/XWIKI-18384
  * https://jira.xwiki.org/browse/XWIKI-18408

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [security ML](mailto:security@xwiki.org)
Vulnerability: GHSA-c2h6-7gm8-cv4w
Summary: XSS in MITREid Connect
Aliases: CVE-2020-5497
Severity: MODERATE
CWE: CWE-79
Published: 2020-04-01T16:35:44Z

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript.
Vulnerability: GHSA-99qr-9cc9-fv2x
Summary: Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main
Aliases: CVE-2017-3166
Severity: MODERATE
CWE: CWE-732
Published: 2018-12-21T17:50:03Z

In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any application that requests to localize that file.
Vulnerability: GHSA-rq96-qhc5-vm4r
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Apache NiFi
Aliases: CVE-2021-44145
Severity: MODERATE
CWE: CWE-200
Published: 2022-01-05T17:33:32Z

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.
Vulnerability: GHSA-ghq2-m3pq-qf3p
Summary: Stored XSS in Jenkins CVS Plugin
Aliases: CVE-2022-29037
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-13T00:00:18Z

Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Vulnerability: GHSA-r679-m633-g7wc
Summary: Improper input validation in Apache Shiro
Aliases: CVE-2019-12422
Severity: MODERATE
Published: 2020-02-04T22:36:36Z

Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.
Vulnerability: GHSA-vq9j-jh62-5hmp
Summary: Apache Camel using an outdated vulnerable JSON-lib library
Aliases: CVE-2017-5643
Severity: HIGH
CWE: CWE-918
Published: 2018-10-16T23:13:11Z

Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.
Vulnerability: GHSA-hmq6-frv3-4727
Summary: High severity vulnerability that affects com.fasterxml.jackson.dataformat:jackson-dataformat-xml
Aliases: CVE-2016-3720
Severity: CRITICAL
CWE: CWE-611
Published: 2018-10-18T17:43:16Z

XML external entity (XXE) vulnerability in XmlMapper in the Data format extension for Jackson (aka jackson-dataformat-xml) allows attackers to have unspecified impact via unknown vectors.
Vulnerability: GHSA-v62j-fcxq-j239
Summary: Stored XSS in Apache Atlas
Aliases: CVE-2019-10070
Severity: MODERATE
CWE: CWE-79
Published: 2020-01-08T17:26:53Z

Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionality
Vulnerability: GHSA-f554-x222-wgf7
Summary: Command Injection in Xstream
Aliases: CVE-2013-7285
Severity: CRITICAL
CWE: CWE-77, CWE-78
Published: 2019-05-29T18:05:03Z

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
Vulnerability: GHSA-mfwh-gqx8-c787
Summary: Allocation of Resources Without Limits or Throttling in Apache Tika
Aliases: CVE-2019-10088
Severity: HIGH
CWE: CWE-770
Published: 2019-08-06T01:43:40Z

A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.
Vulnerability: GHSA-53hp-jpwq-2jgq
Summary: Uncontrolled Resource Consumption in Apache Tomcat
Aliases: CVE-2020-11996
Severity: HIGH
CWE: CWE-400
Published: 2022-02-09T23:01:22Z

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
Vulnerability: GHSA-hqqv-9x3v-mp7w
Summary: Privilege Escalation Flaw in Elasticsearch
Aliases: CVE-2020-7014
Severity: MODERATE
CWE: CWE-269, CWE-266
Published: 2021-03-18T19:27:20Z

The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication token can perform a series of steps that result in an authentication token being generated with elevated privileges.
Vulnerability: GHSA-xmw9-q7x9-j5qc
Summary: Unbounded connection acceptance leads to file handle exhaustion
Aliases: CVE-2021-21293
Severity: HIGH
CWE: CWE-400
Published: 2021-02-02T21:42:49Z

### Impact

All servers running blaze-core <= 0.14.14, including blaze-http and http4s-blaze-server users, are affected.

Blaze, accepts connections unconditionally on a dedicated thread pool. This has the net effect of amplifying degradation in services that are unable to handle their current request load, since incoming connections are still accepted and added to an unbounded queue. Each connection allocates a socket handle, which drains a scarce OS resource. This can also confound higher level circuit breakers which work based on detecting failed connections.

The vast majority of affected users are using it as part of http4s-blaze-server <= 0.21.16.  http4s provides a mechanism for limiting open connections, but is enforced inside the Blaze accept loop, after the connection is accepted and the socket opened. Thus, the limit only prevents the number of connections which can be simultaneously processed, not the number of connections which can be held open.

### Patches

The issue is fixed in version 0.14.15 for `NIO1SocketServerGroup`.  A `maxConnections` parameter is added, with a default value of 512.  Concurrent connections beyond this limit are rejected.  To run unbounded, which is not recommended, set a negative number.

The `NIO2SocketServerGroup`  has no such setting and is now deprecated.

### Workarounds
* An Nginx side-car acting as a reverse proxy for the local http4s-blaze-server instance would be able to apply a connection limiting semantic before the sockets reach blaze-core. Nginx’s connection bounding is both asynchronous and properly respects backpressure.
* A similar sidecar strategy is viable for other non-HTTP services running on blaze-core.
* http4s-ember-server is an alternative to http4s-blaze-server, but does not yet have HTTP/2 or web socket support.  Its performance in terms of RPS is appreciably behind Blaze’s, and as the newest backend, has substantially less industrial uptake.
* http4s-jetty is an alternative to http4s-blaze-server, but does not yet have web socket support.  Its performance in terms of requests per second is somewhat behind Blaze’s, and despite Jetty's industrial adoption, the http4s integration has substantially less industrial uptake.
* http4s-tomcat is an alternative to http4s-blaze-server, but does not yet have HTTP/2 web socket support.  Its performance in terms of requests per second is somewhat behind Blaze’s, and despite Jetty's industrial adoption, the http4s integration has substantially less industrial uptake.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [http4s/blaze](http://github.com/http4s/blaze)
* Contact us according to the [http4s security policy](https://github.com/http4s/http4s/security/policy)
Vulnerability: GHSA-vwpg-f6gw-rjvf
Summary: Incorrect Authorization in Spring Cloud Netflix Zuul
Aliases: CVE-2021-22113
Severity: MODERATE
CWE: CWE-863
Published: 2021-05-10T15:18:50Z

Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive Headers” restriction when executing requests with specially constructed URLs. Applications that use Spring Security's StrictHttpFirewall (enabled by default for all URLs) are not affected by the vulnerability, as they reject requests that allow bypassing.
Vulnerability: GHSA-h77f-xxx7-4858
Summary: User impersonation due to incorrect handling of the login JWT
Aliases: CVE-2021-39177
Severity: HIGH
CWE: CWE-287
Published: 2021-09-07T23:04:04Z

### Impact
<!--_What kind of vulnerability is it? Who is impacted?_-->
This allows anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any Bedrock user. Unless credentials are saved in your configuration, online mode is not affected as users are still required to log in separately. If your credentials are saved, there is no risk of exposing your email or password.

### Patches
<!--_Has the problem been patched? What versions should users upgrade to?_-->
This was patched as part of https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6 and https://github.com/GeyserMC/Geyser/commit/ab2f5b326fe590e09167e8b45b4b165ac06ecd13. if your Geyser version is `1.4.2-SNAPSHOT` or later, the issue has been addressed on your build.

### Workarounds
<!--_Is there a way for users to fix or remediate the vulnerability without upgrading?_-->
Geyser strongly recommends updating to fix this issue. If this isn't possible:
- Use online mode and don't save credentials in your Geyser configuration
- Use an additional authentication method on the Java server

### References
<!--_Are there any links users can visit to find out more?_-->
This was disclosed to us by a staff member over at Hive; you can read their disclosure here: https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY

### For more information
If you have any questions or comments about this advisory:
* Come talk to us over on our [Discord](https://discord.gg/geysermc) server in the [#development](https://discord.com/channels/613163671870242838/613170125696270357) channel
Vulnerability: GHSA-793h-6f7r-6qvm
Summary: Authenticated users can read data from other sources than intended
Aliases: CVE-2021-26920
Severity: MODERATE
CWE: CWE-863
Published: 2021-08-13T15:21:50Z

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource.