Apache jclouds is an open source multi-cloud toolkit for the Java platform that gives you the freedom to create applications that are portable across clouds while giving you full control to use cloud-specific features. The jclouds API gives you the freedom to use portable abstractions or cloud-specific features. jclouds tests support of 30 cloud providers and cloud software stacks including Amazon, Azure, GoGrid, OpenStack, Rackspace, and Google.
Apache jclouds suffers from an XML External Entity (XXE) injection vulnerability in its provider-response parsing. The SAX parser factory built by SaxParserModule is created without disabling document type definitions or external entities, and it is used to parse every provider HTTP response, so when the parsed endpoint is attacker-influenced (a BYO or S3-compatible endpoint, a man-in-the-middle, or a malicious provider) the library can be made to read local files or perform server-side request forgery on the jclouds host.