Sometimes I get sick of the misinformation about Java that gets bandied about. The security issues related to Java that people continually clamor about are related to Java Applets and Java Webstart. The former no one really codes anymore, except mainly nefarious hackers. Browser Applets are a relic from the late 90s, which were useful once upon a time, but are now obsolete. Java Webstart is used a fair amount, but server side Java is where the vast majority of Java development is done— Android development would be second. And server side Java does not suffer from the security related problems that were headlines last year. Server side Java is what you would be using to build your web app. I am not saying that there are absolutely no security vulnerabilities in Java server side code, but any security vulnerabilities would more than likely be caused by the server container, the container's configuration, or the configuration of the machine hosting the container and not Java itself. And if a rogue hacker can directly access the machine hosting your sever side code, you have bigger problems than any potential security flaws in Java.
And remember, many of the largest web companies in the world widely use server side Java; Google, Facebook, and Twitter, just to name a few. If Java were so vulnerable, it is doubtful they would use it.
To answer your questions, yes, you can have a Java web app access multiple databases, as long as there are JDBC drivers (or a Java driver for nosql databases) available for the databases you want to access. MySQL, PostgreSQL, Oracle, Sybase, MongoDB, CouchDB, Cassandra, and Oracle NoSQL all have Java drivers available.
How you configure your web application to access your databases depends on what container you will be using. Will you be using a simple WebApp container like Tomcat? Will you be adding web functionality to a standalone Java App using Jetty? Will you be using a full JEE container like Glassfish, JBoss, or WebLogic? Or will you be using a lightweight container like the Play Framework or plain Akka?
If you are using a relational DB like MySQL or Oracle most of these containers allow you to configure database connection pools and data sources within the container itself and where you need to access a database, you simple inject or mix in the particular database connection in your code. For nosql database connections, configuring connections takes a little more work for some of these containers, but is still pretty easy to configure.
If you are going to use a full JEE app server you will probably want to use JPA and/or Hibernate to abstract your data access and transaction management rather than directly access the databases. If you are going to use Tomcat, you will probably want to package Hibernate with your web app, and again use that for data access and transaction management.