legacy vulnerabilities