Using Components with Known Vulnerabilities