I think one of the big problems with every methodology, and every attempt to come up with a unified vulnerability ontology, is that a security bug is just “whatever the user doesn’t like.” These types of things always run into problems caused by the mixing of syntactic and semantic vulnerabilities, without attempting to distinguish between the two.