A metric for software vulnerabilities classification