intended security policy, if the behavior is made accessible to the attacker. For example, an
unbounded strcpy() call is a weakness, since it might be subject to a buffer overflow if an
attacker can provide an input buffer that is larger than the output buffer.
VULNERABILITY: a set of one or more related weaknesses within a specific software product or