system: You are an expert security code reviewer. You will be shown a source code file along with a multi-select question listing several CWE (Common Weakness Enumeration) categories. Your task is to identify which of the listed CWEs are present in the code.

OUTPUT FORMAT: Respond with the letter(s) of all correct options, sorted alphabetically and comma-separated, wrapped in a single \boxed{...}. Examples: `\boxed{A}` for one correct, `\boxed{A,C}` for two, `\boxed{A,C,E}` for three. Output the boxed answer ONLY -- no explanation, no other text.

user: ```python
import RPi.GPIO as GPIO
import time
import subprocess
import datetime
import pprint
import os

import led
import gpsdata
import gpstime
import imudata

BCM_led = 18
BCM_btn = 22

led.BCM_led = BCM_led

GPIO.setmode(GPIO.BCM)
GPIO.setwarnings(False)
GPIO.setup(BCM_led, GPIO.OUT)
GPIO.setup(BCM_btn, GPIO.IN, pull_up_down=GPIO.PUD_DOWN)

booting = True
recording = False

def displayIPaddress():
    global booting
    print("booting...")
    while booting:
        # get IP address; ref: https://circuitdigest.com/microcontroller-projects/display-ip-address-of-raspberry-pi
        rc, ipaddr = subprocess.getstatusoutput('hostname -I')
        # ipaddr = commands.getoutput('ifconfig wlan0 | grep "inet" | cut -d" " -f10')
        led.bing(3, 0.05)
        time.sleep(1.0)
        if (len(ipaddr) > 0):
            print(ipaddr)
            led.encodeIP(ipaddr)
    GPIO.output(BCM_led, GPIO.LOW)
    print("booting...DONE")

def onBtnPushed(channel):
    global booting
    global recording
    print("pushed")
    booting = False
    recording = True
    led.terminate = True

def record():
    global recording
    print("recording...")
    filename = "/home/pi/data/" + time.strftime("%Y%m%d-%H%M%S")+'-data.csv'
    print(filename)
    f = open(filename,'w')

    f.write("datetime," + gpsdata.getGPSheader() + "," + imudata.getIMUmeasureGheader() + "," + imudata.getIMUdataHeader() + "\n")

    btnled = led.FlashingLED(0.1, 0.9)
    btnled.start()

    imudata.resetIMUdata()
    while True:
        time.sleep(0.1)
        data = str(datetime.datetime.now()) + "," + gpsdata.getGPSrecord() + "," + imudata.getIMUmeasureG() + "," + imudata.getIMUdata()
        # print(data)
        f.write(data + "\n")
        if not GPIO.input(BCM_btn):
            break
    btnled.stop()

    f.flush()
    f.close()
    os.chmod(filename, 0o666)
    os.sync()
    recording = False
    print("recording...done")

def idle():
    GPIO.output(BCM_led, GPIO.HIGH)
    time.sleep(0.2)
    GPIO.output(BCM_led, GPIO.LOW)
    time.sleep(4.0)

GPIO.add_event_detect(BCM_btn, GPIO.RISING, callback=onBtnPushed)

gpsp = gpsdata.GpsPoller() # create the thread

try:
    btnled = led.FlashingLED(0.5, 0.5)
    btnled.start()
    gpsp.start() # start up the GPS thread
    time.sleep(2)
    gpstime.setGPSTime()
    btnled.stop()

    displayIPaddress()

    while True:
        if recording:
            record()
        else:
            idle()

except (KeyboardInterrupt, SystemExit): # when you press ctrl+c
    print("Exiting...")

finally:
    gpsp.running = False
    GPIO.cleanup()
    gpsp.join()

```

Which of the following CWE vulnerability categories are present in this code? Multiple options may be correct.

  A) CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  B) CWE-20: Improper Input Validation
  C) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
  D) CWE-918: Server-Side Request Forgery (SSRF)
  E) CWE-732: Incorrect Permission Assignment for Critical Resource
  F) CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
Answer: E