» Weakness Prevalence: how often the weakness appears in software that was not developed with security
integrated into the software development life cycle (SDLC).
» Consequences: the typical consequences of exploiting a weakness if it is present, such as unexpected code
execution, data loss, or denial of service.