Upgrade to 7.
You're on an old version which has known security issues, and is no longer supported, so there's no patches or fixes available for most of these.
Although I would point out that
5. This is a failure of your security scans, not Jira. You want autocomplete enabled so that users can use password safes in their browsers. If they do not, then they will use weak passwords and/or write them down. (And you can override "autocomplete off" with some trivial tricks in a browser, so the test is pointless anyway)
7. Go to admin -> global permissions, and remove all groups from "browse users". That will remove all email.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.