Don't characterize XML vulnerabilities as DoS-only.