Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create

Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation

This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder