Index: /trunk/src/org/openstreetmap/josm/data/imagery/WMTSTileSource.java
===================================================================
--- /trunk/src/org/openstreetmap/josm/data/imagery/WMTSTileSource.java	(revision 9663)
+++ /trunk/src/org/openstreetmap/josm/data/imagery/WMTSTileSource.java	(revision 9664)
@@ -268,4 +268,9 @@
     private Collection<Layer> getCapabilities() throws IOException {
         XMLInputFactory factory = XMLInputFactory.newFactory();
+        // do not try to load external entities, nor validate the XML
+        factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
+        factory.setProperty(XMLInputFactory.IS_VALIDATING, false);
+        factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+
         InputStream in = new CachedFile(baseUrl).
                 setHttpHeaders(headers).
@@ -280,5 +285,5 @@
             XMLStreamReader reader = factory.createXMLStreamReader(new ByteArrayInputStream(data));
 
-            Collection<Layer> ret = null;
+            Collection<Layer> ret = new ArrayList<>();
             for (int event = reader.getEventType(); reader.hasNext(); event = reader.next()) {
                 if (event == XMLStreamReader.START_ELEMENT) {