fix PCE vulnerabilities identified in sonar