SCQS reports some XXE erros. F.e. Rule -
    > java:S2755 [XML parsers should not be vulnerable to XXE attacks]

    > common/lib/sigtest/src/share/classes/com/sun/tdk/signaturetest/sigfile/f43/F43Writer.java
    > common/lib/sigtest/src/share/classes/com/sun/tdk/signaturetest/sigfile/StructWriter.java
    > common/lib/sigtest/src/share/classes/com/sun/tdk/signaturetest/updater/Updater.java

While there is no real vulnerability here these erros can be fixed.