attempted to define a taxonomy of operating system security defects that
included seven major categories of flaws, five of which are still cited as software
vulnerability categories (the other two were categories of information, rather
than software, security vulnerabilities)—