client vulnerability