Vulnerabilities in Configuration as Code