sox vulnerabilities