An unspecified vulnerability in Java SE related to the JAXP component could allow a remote attacker to cause high confidentiality impact, no integrity impact, and no availability impact.
Apache POI is vulnerable to a buffer overflow, caused by a missing sanity check for length of embedded OLE10Native. By sending a specially-crafted request, a remote attacker could overflow a buffer and execute arbitrary code on the system.