What is a web session vulnerability that allows attackers using attacks such as cross$-$site scripting $($XSS$)$ to retrieve session identifiers and reuse a session?

A$.$ Inclusion of unprotected information in cookies

B$.$ Improper or poor web design

C$.$ Long$-$lived sessions

D$.$ Absent or inadequate password change controls