xss
file descriptor
race condition
file and directory permissions
sym links