Missing (or incorrectly used) modifier on a function allows an attacker to use sensitive functionality in the contract.
A contract with a
changeOwner function does not label it as
private and therefore
allows anyone to become the contract owner.
Always specify a modifier for functions.