external vulnerability