In organization discovers that its secure file transfer protocol (SFTP) server has been accessed by an unauthorized person to download an unreleased game. A recent security audit found weaknesses in s

Buffer overflow attacks exploit unpatched software vulnerabilities where input validation flaws allow attackers to overwrite memory and execute arbitrary code. The audit specifically flagged weak software change control and patch management - these are precisely the controls that would prevent buffer overflow exploits from being present in production systems. An unpatched SFTP server with a known buffer overflow vulnerability would allow unauthorized access without needing valid credentials.

Weak passwords due to lack of complexity rules would indicate a failure in access control or account management policies, but the audit found weaknesses only in software change control and patch management, not in other control areas such as identity and access management.

A DDoS attack is designed to overwhelm and deny availability of a service to legitimate users, not to gain unauthorized access and exfiltrate data such as downloading a game file.

Cross-Site Scripting (XSS) is a web application attack that injects malicious scripts into web pages viewed by other users, which is unrelated to unauthorized access to an SFTP server and does not align with the identified patch management weaknesses.