Apache PDFBox versions 1.8.0 through 1.8.11 and 2.0.0 suffer from an XML external entity injection vulnerability.
f160d0f59531b7124fd63893410f4382449ef5be4212ce0538851d88587946e3
Apache Tika versions 0.10 through 1.12 suffer from an XXE injection vulnerability.
f33971406fb04b391007116a0482ffc39feb7e43a3c815760b26a24fb10693d3