A weakness or lack of a safeguard, which may be exploited by a threat, causing harm to the information systems or networks is called a ?