More java holes found in google app engine