A flaw was found in dom4j library. By using the default SaxReader() provided by Dom4J, external DTDs and External Entities are allowed, resulting in a possible XXE.
A flaw was found in quartz through version 2.3.0. A XXE attack is possible in the Terracotta Quartz Scheduler using a job description. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.