EDIT: An attacker could craft malicious input that cause the web services software to perform operations on behalf of the attacker. Classes of injection flaws include Cross Site Scripting (XSS), SQL Injection and XPath Injection. Parsing XML can be processor intensive and complex, which can lead to security issues. One common issue is a denial of service (DoS) against a web service. If an attacker crafts an XML message with very large payloads, recursive content, excessive nesting, malicious external entities, or with malicious DTDs (Data Type Documents), a DoS can occur. Source: http://www.slideshare.net/Zubin67/service-oriented-architecture-security-vulnerabilities-web