A9 – Using Known Vulnerable Components